Overview

overview

10

Static

static

1

f7debb28e4...103.js

windows7-x64

10

f7debb28e4...103.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7debb28e4cb5808148ee09ea605aada5964208d031bdd9d05277408e85f3103

  • Size

    1.4MB

  • Sample

    250120-vk87kszle1

  • MD5

    e60c0fb1560c7d984fa7629f15482e93

  • SHA1

    ca8672d5c7570719cfa4908a5a4d3af4c59fbfc1

  • SHA256

    bfb9031b14c19616303c2ee7efdd18b3f820b27a52684ca9819a87c29d353e49

  • SHA512

    a4891f59a7135d3e3abd49193662596abad2b60fd93b22ee3978afd72fd97bf4b5b9d9ee5298eaf7f9fd7547cc777ff30ca47852174a1ed931fd40a8b5e69261

  • SSDEEP

    24576:7XYO1esCJ9d9UlLl7ud2FM2q+7qPTTvlqRaW4/18C8qCj9EDWTTDVRLa8:cO1esCPdu7s7OqP9UaZ6CxKEDiTDVRL1

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      f7debb28e4cb5808148ee09ea605aada5964208d031bdd9d05277408e85f3103

    • Size

      4.1MB

    • MD5

      40952de7adcb0e98c28a63eaa7bf7a0e

    • SHA1

      eb1c4358d2851f7499360f3a8e274de3f35dd828

    • SHA256

      f7debb28e4cb5808148ee09ea605aada5964208d031bdd9d05277408e85f3103

    • SHA512

      a3efea122f7e072ac70c2303adea37de2fc21626fa030687b3b7da424f7581ce4ab2f5fea5a6094d191d67bc55d99ccd14ebf0e55fa8697b5e005b783ac6995a

    • SSDEEP

      49152:Nsz6FvpOiHY7sz6FvpOiHYH9qZKpKmKZK7K6wTiAmMOsyzCu9C0W0w0i0GpMxkS7:N0WQ0Wq

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks