netsupport | 78dba97ea743f3b5a3c3a7a8b410d34a62fd23c3ca95c4ca2d4048e4610b682b | Triage

Sharing

General

Target

files.zip
Size

6.6MB
Sample

250116-sgzsmawkhx
MD5

b72621a86d35daf99d963ffd13206315
SHA1

ef199736953f7d70c90c5401c5158bdc7b5a9073
SHA256

78dba97ea743f3b5a3c3a7a8b410d34a62fd23c3ca95c4ca2d4048e4610b682b
SHA512

6870b6f3bc21a6550c9ee228a26f8b73b36badd8f3a7d04bc742ff4336347e593700866ae143ba8143f325c579ed5cda88996c8bc93ac53aa5bb63e0a18ecbb0
SSDEEP

196608:QA+K0gEKwQkQPnaV4nxeJQAnTIm/wGwkbV4QHRFC:QDjK3l64nxeJQAn5/wiB4QS

Score

10^/10

netsupport discovery rat

Malware Config

Targets

- Target
  
  EmbeddedBrowserWebView.dll
- Size
  
  5.1MB
- MD5
  
  1350e509981c8626a2248e68dabd41b8
- SHA1
  
  d2b01e598e85dd3a40d92ff37f55f7686f565f02
- SHA256
  
  6d7c9c0dcb37183772adab57dcbb1558e933b6921ccc1cf590eb36263bd89aab
- SHA512
  
  e6ef921e590f05b7ebc754ea0876e78502bbcf0085ed66d996df6c9432ec2f6819e4c804a6a8de2873d88f2d98cd6312654138de570ad878bfc9c546e45165c2
- SSDEEP
  
  49152:Vjm9GCXSRvcRhXFaC7Jufgl6XLQmyn1ZCvmIfAPnnFdbR/vqT7wmoKvwTfq5xXPR:6RLx95IqHtVkzPW0i7m
Score

1^/10
behavioral1
- Target
  
  HTCTL32.DLL
- Size
  
  320KB
- MD5
  
  c94005d2dcd2a54e40510344e0bb9435
- SHA1
  
  55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA256
  
  3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- SHA512
  
  2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP
  
  6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Score

3^/10

discovery
behavioral2 behavioral3
- Target
  
  PCICHEK.DLL
- Size
  
  18KB
- MD5
  
  104b30fef04433a2d2fd1d5f99f179fe
- SHA1
  
  ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA256
  
  956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- SHA512
  
  5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP
  
  192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  
  PCICL32.DLL
- Size
  
  3.6MB
- MD5
  
  d3d39180e85700f72aaae25e40c125ff
- SHA1
  
  f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA256
  
  38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- SHA512
  
  471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP
  
  49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  
  TCCTL32.DLL
- Size
  
  387KB
- MD5
  
  2c88d947a5794cf995d2f465f1cb9d10
- SHA1
  
  c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA256
  
  2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- SHA512
  
  e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP
  
  12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  
  client32.exe
- Size
  
  101KB
- MD5
  
  c4f1b50e3111d29774f7525039ff7086
- SHA1
  
  57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA256
  
  18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- SHA512
  
  005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP
  
  768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score

10^/10

netsupport discovery rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
behavioral10 behavioral11
- Target
  
  folder/a3dapi.dll
- Size
  
  206KB
- MD5
  
  0b3f04a2757f5e43140ac81db1afdc42
- SHA1
  
  57c666aebb0fb59ac86deae9e6849e3268a05703
- SHA256
  
  f05b2eeb851b174ef2b39c4728687915648ae33780a65cdf7f0c7ce99e6a67af
- SHA512
  
  1df19cac3b3ca5a45b50ceddf3e7ecf60b8521c9b589d9c47219ce8d056d6d244516922627fd522818fd8383788924a6589baba9f3984f749ebb992e4de327b0
- SSDEEP
  
  6144:5atuZySlWDRI0jcAwcwypEGmFPHrA/8/5mB:55yd3EcbpEGmFPVkB
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  
  folder/appcore.dll
- Size
  
  749KB
- MD5
  
  3a4b0216fb0d9ed1b670f8d85b7ad0da
- SHA1
  
  1922c7f515fe05b4355cf72f9aad5dbb30762b7a
- SHA256
  
  577d3cfe60ac262b3111b5679bde1edc0092713f541ca7b7284d2cad94fbeff3
- SHA512
  
  8e64c8cb76aac21aa910d92639ac37608da3ef12ba95817550e83f917a9e9480052ac8aee8d36a82c62252dd4e1da60701bb13eb4419604dad5676ed8555b55b
- SSDEEP
  
  6144:6pbQaH5UzimjGz+rCC3O3SpnoZQVciyktEeI9FGdqjQqreI78pTSgQhmtR7DqU+7:OQaHfmjCgasEeI9FGdqMq6XQWR7DeHb
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  
  folder/apprun.dll
- Size
  
  740KB
- MD5
  
  975ea37829f057463e66b3c237f1c27a
- SHA1
  
  972cb78912f7e975383a8137a2e982b25333e633
- SHA256
  
  8b496688cf2d963eca198f0291d1448b0f357fbd764e22db7dcc7b252bd71562
- SHA512
  
  8463210ed0238785848a65b0d51fbe6b0f67e01a1659a0db5ee9493a1ef3ea9fcd504246e3fde5898ad60692d106319845ebedf6bd9dc159e6b2bfe307ff3d8a
- SSDEEP
  
  12288:6YTLcf1B27YNcwmSLkpeV2FEPctWntF3OwdWR7De/:scwmSPcOyQ3OwdWRXe/
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  
  folder/avcodec-53.dll
- Size
  
  1.0MB
- MD5
  
  bba1fe328cea501fcce1e5df16276439
- SHA1
  
  ed4ad3a8d6f0e3dd86abb19bc18127f960ea2131
- SHA256
  
  f5522d2c936de8d53f97a6ec439d8f8391cb50a0bc6008a399f9454c00929d35
- SHA512
  
  8f585d57baa39d3e5e6b62efea53b6b3797319ae86c0c4373774d08e284a49c0bd005e200ae4fabc789470b3f100f98c8ce503fd4702f79dcbf4be4aabc58a9e
- SSDEEP
  
  24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  
  hidapi.dll
- Size
  
  51KB
- MD5
  
  e3b9b23eefebb010d6a96945688f40d8
- SHA1
  
  66ed4643e7cb18b543f3ba7656ee5abf72232466
- SHA256
  
  cd9baaaf76e5f20d86ccc7d3a31768de0f8af0125fce1fd95783cf2a4d44b487
- SHA512
  
  ba0d1cf4e5428ce39c11a5cdb0f9fd189643335a1c931ca5e7ed1e6f9dcf0f733b26ba6df2f5e6350c3665095c653eb84877e7712fdf4d478d29de4572e0afd0
- SSDEEP
  
  768:wfN552s9JH4okvqjQPh23NEZ/6+R1CnEDfn219egVLm9kxdHkxxn23+zj5:wfN5519JHa23R+R3T5KxdExU25
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  
  msvcr100.dll
- Size
  
  755KB
- MD5
  
  0e37fbfa79d349d672456923ec5fbbe3
- SHA1
  
  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA256
  
  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- SHA512
  
  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP
  
  12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  
  pcicapi.dll
- Size
  
  32KB
- MD5
  
  34dfb87e4200d852d1fb45dc48f93cfc
- SHA1
  
  35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA256
  
  2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- SHA512
  
  f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP
  
  768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  
  remcmdstub.exe
- Size
  
  62KB
- MD5
  
  6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1
  
  b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA256
  
  fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- SHA512
  
  f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP
  
  1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  
  settings/apprun.dll
- Size
  
  740KB
- MD5
  
  975ea37829f057463e66b3c237f1c27a
- SHA1
  
  972cb78912f7e975383a8137a2e982b25333e633
- SHA256
  
  8b496688cf2d963eca198f0291d1448b0f357fbd764e22db7dcc7b252bd71562
- SHA512
  
  8463210ed0238785848a65b0d51fbe6b0f67e01a1659a0db5ee9493a1ef3ea9fcd504246e3fde5898ad60692d106319845ebedf6bd9dc159e6b2bfe307ff3d8a
- SSDEEP
  
  12288:6YTLcf1B27YNcwmSLkpeV2FEPctWntF3OwdWR7De/:scwmSPcOyQ3OwdWRXe/
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  
  settings/avcodec-53.dll
- Size
  
  1.0MB
- MD5
  
  bba1fe328cea501fcce1e5df16276439
- SHA1
  
  ed4ad3a8d6f0e3dd86abb19bc18127f960ea2131
- SHA256
  
  f5522d2c936de8d53f97a6ec439d8f8391cb50a0bc6008a399f9454c00929d35
- SHA512
  
  8f585d57baa39d3e5e6b62efea53b6b3797319ae86c0c4373774d08e284a49c0bd005e200ae4fabc789470b3f100f98c8ce503fd4702f79dcbf4be4aabc58a9e
- SSDEEP
  
  24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  
  settings/avformat-53.dll
- Size
  
  187KB
- MD5
  
  c5ccb86cd745746b9908031a54315f90
- SHA1
  
  d00147298fc236730a4076d5a03444ac970d053b
- SHA256
  
  ac1f83180e07ac2b3d1e6f80f94aee0b2591be13e8a1fe63998cf7f0a9f18f1e
- SHA512
  
  bcf3b40b241cba632d9fe15426d28f2ce4460523fcb1992d29ba2d85f9ee2973c7c23be0013319a973a11d2eafe882cf611d976ccb5e5877d393a035d652cbcf
- SSDEEP
  
  3072:sr928cq80ZkRaW391QjTnXPXFvbZ8/pLGVg+QwRlkR6j7lA8b:sr929YWaW3YjzpV8/YVg+wR6j7lv
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

netsupportdiscoveryrat

behavioral11

netsupportdiscoveryrat

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32