netsupport | bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa | Triage

Submit
Reports

Overview

overview

Static

static

3

bc5c7fc357...a.appx

windows7-x64

bc5c7fc357...a.appx

windows10-2004-x64

Sharing

General

Target

bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa
Size

10.7MB
Sample

250124-r2jfpssrhz
MD5

0d2d09faa2a3f1295af9d2265668477e
SHA1

fb1fbea8003f73eeb8bd4d4a9c4765443c1a5b76
SHA256

bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa
SHA512

57634682621f1e5aa64efae101f074ef46a7d91b512a2c3aa2dfd24a8215c9a06c0410a750744776cf1f06b0b8c538a56bcbd10d01e3ad80e0b899c6e3172aa4
SSDEEP

196608:fyF7yF26K4sXO1/pmANI2C2Uh4KghEUUufMLoWaOJ6wfWUi7OOe8V2rYMTYtL4:fyskAplXUVghyufsJPfWLOOe8grIR4

Score

10^/10

netsupport discovery execution persistence privilege_escalation rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa.appx

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa.appx

Resource

win10v2004-20241007-en

netsupport discovery execution persistence privilege_escalation rat

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa
- Size
  
  10.7MB
- MD5
  
  0d2d09faa2a3f1295af9d2265668477e
- SHA1
  
  fb1fbea8003f73eeb8bd4d4a9c4765443c1a5b76
- SHA256
  
  bc5c7fc357244b8cdb1d79c545c4ac5d20ba770d028dd4bc66a00dd4ba2679fa
- SHA512
  
  57634682621f1e5aa64efae101f074ef46a7d91b512a2c3aa2dfd24a8215c9a06c0410a750744776cf1f06b0b8c538a56bcbd10d01e3ad80e0b899c6e3172aa4
- SSDEEP
  
  196608:fyF7yF26K4sXO1/pmANI2C2Uh4KghEUUufMLoWaOJ6wfWUi7OOe8V2rYMTYtL4:fyskAplXUVghyufsJPfWLOOe8grIR4
Score

10^/10

netsupport discovery execution persistence privilege_escalation rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Blocklisted process makes network request
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

netsupportdiscoveryexecutionpersistenceprivilege_escalationrat

© 2018-2025

Terms | Privacy