Overview

overview

10

Static

static

1

Payment497.js

windows7-x64

10

Payment497.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment497.js

  • Size

    4.3MB

  • Sample

    250120-sg1pxsvqan

  • MD5

    a97b73d3ebdb197a46a89b6b92fec7d8

  • SHA1

    933a51bc9b003229a25a2fae3e53fef529947694

  • SHA256

    92310badbfc3b6c54981ebd85c1ebd31ecfe36f5fe1a0ae9a28fa4a55c77144d

  • SHA512

    bbf63ca7a89b8a5b58f0a8ca50667cfeb548d3cc3c78b859efaa72223c423f9b25775e63e1180b2b60926f86107c0690d7f8722009228b3bb1f8088d272a101f

  • SSDEEP

    49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/OBChWeMNLGr:h53S5S

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      Payment497.js

    • Size

      4.3MB

    • MD5

      a97b73d3ebdb197a46a89b6b92fec7d8

    • SHA1

      933a51bc9b003229a25a2fae3e53fef529947694

    • SHA256

      92310badbfc3b6c54981ebd85c1ebd31ecfe36f5fe1a0ae9a28fa4a55c77144d

    • SHA512

      bbf63ca7a89b8a5b58f0a8ca50667cfeb548d3cc3c78b859efaa72223c423f9b25775e63e1180b2b60926f86107c0690d7f8722009228b3bb1f8088d272a101f

    • SSDEEP

      49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/OBChWeMNLGr:h53S5S

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks