Overview

overview

10

Static

static

1

Payment_497.js

windows7-x64

10

Payment_497.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_497.rar

  • Size

    1.4MB

  • Sample

    250120-r9v5gavlhk

  • MD5

    cbe6e3383d602a1fc218021221dffe48

  • SHA1

    32bd0e5769a373dfc78d5c60b32852c837c315da

  • SHA256

    117f885254e055490d84113e6837dbdb7dc992e3399f11664a4faae8b833ec50

  • SHA512

    dd0018975cc3deeeef86620483b0444f2cd6ea8eda70ca9f77a53f55cfadbc202baa43bcbd5f237a894f7fcb0bc593163fbece732605cd3189dea5b2e530454a

  • SSDEEP

    24576:XHlIotqKt4Pw+fdliTdzxIe7DSblH2dgBbF8TKlkgI/BM/FH1Zxr5HjLEw:3zt3tSyHvPylWdKhWO/nHr5p

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      Payment_497.js

    • Size

      4.3MB

    • MD5

      a97b73d3ebdb197a46a89b6b92fec7d8

    • SHA1

      933a51bc9b003229a25a2fae3e53fef529947694

    • SHA256

      92310badbfc3b6c54981ebd85c1ebd31ecfe36f5fe1a0ae9a28fa4a55c77144d

    • SHA512

      bbf63ca7a89b8a5b58f0a8ca50667cfeb548d3cc3c78b859efaa72223c423f9b25775e63e1180b2b60926f86107c0690d7f8722009228b3bb1f8088d272a101f

    • SSDEEP

      49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/OBChWeMNLGr:h53S5S

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks