netsupport | 3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f | Triage

Submit
Reports

Overview

overview

Static

static

3

3cfcb57b94...f.appx

windows7-x64

3cfcb57b94...f.appx

windows10-2004-x64

Sharing

General

Target

3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f
Size

10.7MB
Sample

250124-rvgzasvjel
MD5

4517c27e7e4cc5329bf9b8003e6836a4
SHA1

85420ec4a78a87780a4909ef8c6dbd5999666da2
SHA256

3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f
SHA512

87868991708e0b4cc3595e98d0eff9e4e61958b6aa2542cf13b909dfc824771896ba0a5e6e972caa3d82b77acc47c50f457e978970dfd2e5e257633010cb0dca
SSDEEP

196608:fyF7yF26K4sXO1/pmANI2C2Uh4KghEUUufMLoWaOJ6wfWUi7OOe8V2rYMTYtLNG:fyskAplXUVghyufsJPfWLOOe8grIRNG

Score

10^/10

netsupport discovery execution persistence privilege_escalation rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f.appx

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f.appx

Resource

win10v2004-20241007-en

netsupport discovery execution persistence privilege_escalation rat

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f
- Size
  
  10.7MB
- MD5
  
  4517c27e7e4cc5329bf9b8003e6836a4
- SHA1
  
  85420ec4a78a87780a4909ef8c6dbd5999666da2
- SHA256
  
  3cfcb57b94e69372cd2815dc63d66ab4b4ac4fec48b3b092f76ae5c9beaa353f
- SHA512
  
  87868991708e0b4cc3595e98d0eff9e4e61958b6aa2542cf13b909dfc824771896ba0a5e6e972caa3d82b77acc47c50f457e978970dfd2e5e257633010cb0dca
- SSDEEP
  
  196608:fyF7yF26K4sXO1/pmANI2C2Uh4KghEUUufMLoWaOJ6wfWUi7OOe8V2rYMTYtLNG:fyskAplXUVghyufsJPfWLOOe8grIRNG
Score

10^/10

netsupport discovery execution persistence privilege_escalation rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Blocklisted process makes network request
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

netsupportdiscoveryexecutionpersistenceprivilege_escalationrat

© 2018-2025

Terms | Privacy