netsupport | a604cedca56a1982f5ae38039c46dd8dc10a414309621fc13d0b54533f53b971 | Triage

Sharing

General

Target

bbbb.zip
Size

4.4MB
Sample

250106-vpnfnstrak
MD5

a114026412e798029a8d1db690c16f70
SHA1

7e44807d21b4b918584eb70a62839daeb91c0863
SHA256

a604cedca56a1982f5ae38039c46dd8dc10a414309621fc13d0b54533f53b971
SHA512

768e0c6b797322985025cee35376ff9040ebe2b08bef21fc3ce71888ea5fc82d8bdf52f44a177aadc6683f44490574627f764db7e01335be5b58e88d79f94a06
SSDEEP

98304:qhRFY89YYc9jh23redpmQRZCPtuP6hKAEiIGPfqCPY6hKUEiIGPfQCPzq1wFXa+:qxYoY59V0redpmQRZ0tQ6A6q0Y6AmQ0V

Score

10^/10

netsupport discovery rat

Malware Config

Targets

- Target
  
  HTCTL32.DLL
- Size
  
  320KB
- MD5
  
  c94005d2dcd2a54e40510344e0bb9435
- SHA1
  
  55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA256
  
  3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- SHA512
  
  2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP
  
  6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  PCICHEK.DLL
- Size
  
  18KB
- MD5
  
  104b30fef04433a2d2fd1d5f99f179fe
- SHA1
  
  ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA256
  
  956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- SHA512
  
  5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP
  
  192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  PCICL32.DLL
- Size
  
  3.6MB
- MD5
  
  d3d39180e85700f72aaae25e40c125ff
- SHA1
  
  f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA256
  
  38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- SHA512
  
  471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP
  
  49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  TCCTL32.DLL
- Size
  
  387KB
- MD5
  
  2c88d947a5794cf995d2f465f1cb9d10
- SHA1
  
  c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA256
  
  2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- SHA512
  
  e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP
  
  12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  cksini (2).exe
- Size
  
  85KB
- MD5
  
  953896600dfb86750506706f1599d415
- SHA1
  
  80204dd5ff71618de5e09d8090738672eaa966b0
- SHA256
  
  f37f6c1c401ebaf3f2879f62a524e1d5bb302e0ef5ae867ccfe7fafc7464f47d
- SHA512
  
  06f702a2b09afa24356d2d1fa9331f6351e8ac58394d02edaa6a0673fb25dd02ab790bc8b2b157bdd10e631df59fbbfd5691543e522f92be9922fb95e3140085
- SSDEEP
  
  1536:ZWd+OSckkrNv/FaXdIJQG8Jf6ClkCFyGjNZgXorEzMuHl/B3:YkNckAiJf6CimNZgXorEzMuHl/B3
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  client32.exe
- Size
  
  101KB
- MD5
  
  c4f1b50e3111d29774f7525039ff7086
- SHA1
  
  57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA256
  
  18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- SHA512
  
  005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP
  
  768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score

10^/10

netsupport discovery rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
behavioral11 behavioral12
- Target
  
  false/vp8decoder.dll
- Size
  
  379KB
- MD5
  
  e247666cdea63da5a95aebc135908207
- SHA1
  
  4642f6c3973c41b7d1c9a73111a26c2d7ac9c392
- SHA256
  
  b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
- SHA512
  
  06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
- SSDEEP
  
  6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  false/vp8encoder.dll
- Size
  
  1.6MB
- MD5
  
  d5c2a6ac30e76b7c9b55adf1fe5c1e4a
- SHA1
  
  3d841eb48d1a32b511611d4b9e6eed71e2c373ee
- SHA256
  
  11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
- SHA512
  
  3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
- SSDEEP
  
  49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  false/webmmux.dll
- Size
  
  259KB
- MD5
  
  49c51ace274d7db13caa533880869a4a
- SHA1
  
  b539ed2f1a15e2d4e5c933611d736e0c317b8313
- SHA256
  
  1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
- SHA512
  
  13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
- SSDEEP
  
  3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  msvcr100.dll
- Size
  
  755KB
- MD5
  
  0e37fbfa79d349d672456923ec5fbbe3
- SHA1
  
  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA256
  
  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- SHA512
  
  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP
  
  12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  pcicapi.dll
- Size
  
  32KB
- MD5
  
  34dfb87e4200d852d1fb45dc48f93cfc
- SHA1
  
  35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA256
  
  2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- SHA512
  
  f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP
  
  768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  remcmdstub.exe
- Size
  
  62KB
- MD5
  
  6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1
  
  b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA256
  
  fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- SHA512
  
  f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP
  
  1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  true/api-ms-win-core-localization-l1-2-0.dll
- Size
  
  20KB
- MD5
  
  3b9d034ca8a0345bc8f248927a86bf22
- SHA1
  
  95faf5007daf8ba712a5d17f865f0e7938da662b
- SHA256
  
  a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d
- SHA512
  
  04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc
- SSDEEP
  
  384:9OMw3zdp3bwjGjue9/0jCRrndbVW2hWKgbCA0GftpBjbQywPAOll7PedGGZ:9OMwBprwjGjue9/0jCRrndbzM8iFFGkt
Score

3^/10

discovery
behavioral25
- Target
  
  true/vp8decoder.dll
- Size
  
  379KB
- MD5
  
  e247666cdea63da5a95aebc135908207
- SHA1
  
  4642f6c3973c41b7d1c9a73111a26c2d7ac9c392
- SHA256
  
  b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
- SHA512
  
  06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
- SSDEEP
  
  6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  
  true/vp8encoder.dll
- Size
  
  1.6MB
- MD5
  
  d5c2a6ac30e76b7c9b55adf1fe5c1e4a
- SHA1
  
  3d841eb48d1a32b511611d4b9e6eed71e2c373ee
- SHA256
  
  11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
- SHA512
  
  3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
- SSDEEP
  
  49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  
  true/webmmux.dll
- Size
  
  259KB
- MD5
  
  49c51ace274d7db13caa533880869a4a
- SHA1
  
  b539ed2f1a15e2d4e5c933611d736e0c317b8313
- SHA256
  
  1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
- SHA512
  
  13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
- SSDEEP
  
  3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  
  webmmux.dll
- Size
  
  259KB
- MD5
  
  49c51ace274d7db13caa533880869a4a
- SHA1
  
  b539ed2f1a15e2d4e5c933611d736e0c317b8313
- SHA256
  
  1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
- SHA512
  
  13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
- SSDEEP
  
  3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

netsupportdiscoveryrat

behavioral12

netsupportdiscoveryrat

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32