Overview

overview

10

Static

static

1

20ad8df8b0...7a6.js

windows7-x64

10

20ad8df8b0...7a6.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20ad8df8b01164904a7334e455aac384cbb5d03f18979dc984ca8f5010fe07a6

  • Size

    1.3MB

  • Sample

    250120-tqgtvaxqhs

  • MD5

    30e7e8cb7dd9e3812b2de29b805da9c2

  • SHA1

    ac7d0f1ecd254cf4370aaeed7bd2b2e05bb2a995

  • SHA256

    eae1e6f2bf272fe44e03e50efb04256d8df672b81c369f9ed347d929ee4a60ee

  • SHA512

    d02964e7c376f732764382452cbbdc66be4b827d1d0d889da61a51fa37994e1a69a3f713e534dd1e8e57b482b8800d8cce457b1f6a4097e1b29f54858ec124a0

  • SSDEEP

    24576:IXYO1tJ7AqkUhkFTdpXx0NGTnFQo3WYgfzswqXIRj9IFsSpBG:xO1tJpkUhkF3XekQH3PgtG

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      20ad8df8b01164904a7334e455aac384cbb5d03f18979dc984ca8f5010fe07a6

    • Size

      3.7MB

    • MD5

      50accf05e62a77bed8df71be92c956d9

    • SHA1

      cd31abcdce0a1ca38ec7dcdd6721af2256321c6a

    • SHA256

      20ad8df8b01164904a7334e455aac384cbb5d03f18979dc984ca8f5010fe07a6

    • SHA512

      d96df0e2d41d54b0e0761f2b9ee7fd84d58a18a30c0a8c41bd00ad64986e0d79d379bfaf5f5f8110ad141bc096b89ef0155f46b785adeefb0b42d1425a08fb5b

    • SSDEEP

      49152:Nsz6FvpOiHY7sz6FvpOiHYtMwuhbE6bD74mSNS7S7SSP421Er2+PbdcMmF/Vk:N0WQ0Wt

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks