Overview

overview

10

Static

static

10

f937c4c69f...03.ps1

windows7-x64

6

f937c4c69f...03.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f937c4c69fa5330dfb08fd4ce890d7aa9c6425823322659519cfa0814fe75103.ps1

  • Size

    1KB

  • Sample

    250116-veh37szkev

  • MD5

    fedd4aec169d783a3f1357e42babbf79

  • SHA1

    6f03f2a7a0e6f57c475de2fa65db9a6a8732bd19

  • SHA256

    f937c4c69fa5330dfb08fd4ce890d7aa9c6425823322659519cfa0814fe75103

  • SHA512

    3dcf16ba5f447fd86c804197f9d128b65899a37690282a5da9d99850ae4979261c2fa120eb902155a01d4d35753ac1eb88bfdcd037d71fcaed45d51c5353822f

Score
10/10
netsupportdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://hardcorelegends.com/a/1.png
exe.dropper

http://hardcorelegends.com/a/2.png
exe.dropper

http://hardcorelegends.com/a/3.png
exe.dropper

http://hardcorelegends.com/a/4.png
exe.dropper

http://hardcorelegends.com/a/5.png
exe.dropper

http://hardcorelegends.com/a/6.png
exe.dropper

http://hardcorelegends.com/a/7.png
exe.dropper

http://hardcorelegends.com/a/8.png
exe.dropper

http://hardcorelegends.com/a/9.png
exe.dropper

http://hardcorelegends.com/a/10.png
exe.dropper

http://hardcorelegends.com/a/11.png
exe.dropper

http://hardcorelegends.com/a/12.png

Targets

    • Target

      f937c4c69fa5330dfb08fd4ce890d7aa9c6425823322659519cfa0814fe75103.ps1

    • Size

      1KB

    • MD5

      fedd4aec169d783a3f1357e42babbf79

    • SHA1

      6f03f2a7a0e6f57c475de2fa65db9a6a8732bd19

    • SHA256

      f937c4c69fa5330dfb08fd4ce890d7aa9c6425823322659519cfa0814fe75103

    • SHA512

      3dcf16ba5f447fd86c804197f9d128b65899a37690282a5da9d99850ae4979261c2fa120eb902155a01d4d35753ac1eb88bfdcd037d71fcaed45d51c5353822f

    Score
    10/10
    defense_evasionexecutionpersistencenetsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks