Overview

overview

10

Static

static

3

Firefox.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Firefox.exe.zip

  • Size

    3.4MB

  • Sample

    250129-jvvw6avpcy

  • MD5

    5c0b3e51c7251ea536dc153cf0b781d1

  • SHA1

    905f670d9c75cc419e3ad99e8d7a51da64d9f7ad

  • SHA256

    c1846d86bdd06582f9990a14a1d586cd8bb1227162380020cf51ee026f8c8a96

  • SHA512

    970e5664b4eb9e9243dff639dfc269e42318613ca73c469c94117e658a3f822d1bb945f188642cf379920e947571f6e136bcafa2a85cc834bde065ddcad2a066

  • SSDEEP

    98304:/L5BJ1JyTMZjGEm0PHg2/RfGpd/CfxNHy:/L5BMTcPHgyRen6ZA

Score
10/10
netsupportdiscoverypersistenceratupx

Malware Config

Targets

    • Target

      Firefox.exe.bin

    • Size

      3.8MB

    • MD5

      17f3abc6f3164802c9131c0ef42d0d80

    • SHA1

      8d58b02a13111d063dc6a7045b6b61f877298969

    • SHA256

      c866f5abfc95edff3bbca82f0d06192913842dcbd5982a12a2519cdf88284a52

    • SHA512

      ca3df733d4001402c045f3b99b3a3bbb1f1838deb2d0551ae68fe48cb79378d6e8ad8f4715eed68c02bdc735352490997cad396b4614e7205c1b721207c919e0

    • SSDEEP

      49152:PcW4fEhenfSFS1ZHC5LYyYx4TwLsCKOLZm5LvVxG9sf/6DHRwHBuZPRUaP7x7BjX:PX4cGbXH17iTbOZmZDD6DHRHyazx1X

    Score
    10/10
    netsupportdiscoverypersistenceratupx

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks