Overview

overview

10

Static

static

1

ece96593ba...1ec.js

windows7-x64

10

ece96593ba...1ec.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ece96593baa146d5d43320b54cc99efe707423033dd3a54707f62da30b8411ec

  • Size

    1.3MB

  • Sample

    250120-t5dqqsyndw

  • MD5

    43c21ac285b3959c2da3e1f1ea3909ba

  • SHA1

    5f2958b56f7f782fd43342acdf09ebf36b58be9f

  • SHA256

    e2b699df9133e091bcb606c98db052c6d76f6e172e8393755342c58ff207ab3a

  • SHA512

    f5b7489b08c1f8dd0d782685ffce239341c999a34d3d9746bf235bb4f09f342154a79db578eebc1d0a756f2931624b0bf42721a6b03abe4982267260457c2e8d

  • SSDEEP

    24576:WXYO1ONGdWcbuUhMr7hY33BiZumMiuRzoVt5Tq387D4P20QsAoc:TO1ON7gPD33k5M7RcVtxq38vbsDc

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      ece96593baa146d5d43320b54cc99efe707423033dd3a54707f62da30b8411ec

    • Size

      4.0MB

    • MD5

      5b105052491111a765f56d4089b579c0

    • SHA1

      f3a9091241bec8746c0013ed57c00a1706c14bb1

    • SHA256

      ece96593baa146d5d43320b54cc99efe707423033dd3a54707f62da30b8411ec

    • SHA512

      0db07ad592f4a36c76a1c00f9f100a3417940de0521c63b5c076dcb993423af6013c6b5bcef8c90851e60da8d33c9959ce802b3282102a88166bac57744fab0d

    • SSDEEP

      49152:Nsz6FvpOiHY7sz6FvpOiHYVmgm4ndniS60S6Gy492BRoRqfZYQEgXG9ad3:N0WQ0Wg

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks