netsupport

Sharing

Copy URL

Twitter E-mail

General

Target

prflbmsg.zip
Size

2.0MB
Sample

250204-l6bzjavmdl
MD5

bce64c218ab2d90739e1965f44eaefc9
SHA1

e97838b05200a69c7981afcf9215137936e99416
SHA256

38cb03bb108b88715d554d1141eb734b2dc25b63fc69c4b037e589caa2e77bec
SHA512

90c2b1147e6b524a8b78ad0f23d305c0389c6f9dfe80a2a59aace232bf5f1fd4b8b5c8f05f1faade959a8f62b25d5d3af1b42e60c17b5075bf3e356e1596052c
SSDEEP

49152:SINfCr5pRrsL3HYZuc+2YDEaJPp+1zLAM/85dqNO:jNaVcooc5Y4aJPpc3AM/85dqNO

Score

10^/10

Malware Config

Targets

- Target
  
  AudioCapture.dll
- Size
  
  76KB
- MD5
  
  2a82792f7b45d537edfe58eb758c1197
- SHA1
  
  a039182d4d1ef29c6d8c238f20f7b8218c28f90c
- SHA256
  
  05aa13a6c1d18f691e552f04a996960917202a322d0dacfd330e553ad56978ed
- SHA512
  
  c6c6799b386e0d6489d9346f1d403b03b9425572e7418a93a72c413a4b9413945aaf4ea97a7d7b65772e5e3f00cff65f180f6fef51a26d4fdc2ff063816b5386
- SSDEEP
  
  1536:96Y+zbZm8/v/k957pyPkLDfORFMTlrSWqNj5CdnTrioQ+ywlj5CdnTXZQ+8iA:96Y+HQ8/3k9RppYFclrLqNj5CdnTrIwp
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  HTCTL32.DLL
- Size
  
  306KB
- MD5
  
  3eed18b47412d3f91a394ae880b56ed2
- SHA1
  
  1b521a3ed4a577a33cce78eee627ae02445694ab
- SHA256
  
  13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f
- SHA512
  
  835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990
- SSDEEP
  
  6144:Jd0nVF1ZtRq6itu9i3uxUnNPhMKj8TwFIKhJ08fvF0dGhZUbol:JYZrokUnNPhMY8TwFIcJB0i
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  KBDTAM99.DLL
- Size
  
  7KB
- MD5
  
  ccc736781cf4a49f42cd07c703b3a18b
- SHA1
  
  6ad817d7e8b7e9dc978763305a4cd4f1ab9abb66
- SHA256
  
  000c4b5b50966634df58078511794f83690d693fccf2aca5c970c20981b29556
- SHA512
  
  39245c4ba554a5a178310af2b8578401360bf60efda427332249eca02d6d65e4b419270ba648e4ad36aacca810133f8e4404372dee98a3648c1e4a9b85dedccb
- SSDEEP
  
  96:Ze+NFyw5fGU1irzSJ39uEMpi4nKW8cWwBvv:ZrNgUiyJ393W8cWq
Score

1^/10
behavioral5
- Target
  
  PCICHEK.DLL
- Size
  
  27KB
- MD5
  
  e311935a26ee920d5b7176cfa469253c
- SHA1
  
  eda6c815a02c4c91c9aacd819dc06e32ececf8f0
- SHA256
  
  0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e
- SHA512
  
  48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c
- SSDEEP
  
  768:X52mBHj1XCdnJ8EriRGp9E+l/kaTj1XCdnJ8EZp9E+8iROA:JPBHj5CdnTrioQ+l/kaTj5CdnTZQ+8iX
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  
  PCICL32.DLL
- Size
  
  3.3MB
- MD5
  
  77b3988cbae5a2550caec42cc5e8ec35
- SHA1
  
  5fa1eeb60e881bfd82eb7c3d9e911587982aaa38
- SHA256
  
  650382fe6596c8dc0c1739713c2076d4ddff32d5c177210b1241550bb8148cfd
- SHA512
  
  480f3abef7b799bd604ba9825e2b8cf681e7850373761c579ef181607980d5159c225fb486996e3088f39662f873743d25b52368045d3ae5bd8d45e44d1e8bec
- SSDEEP
  
  49152:oOelFBtdIVwi6FXg334cdqfs5Q9DTroafCcOSENKAZ370T:oOwFBte6BgHOE5gRMSxAZ6
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  
  TsUsbRedirectionGroupPolicyExtension.dll
- Size
  
  13KB
- MD5
  
  d89cda3ff8427da82de6cce39008c5bc
- SHA1
  
  33889517517b8953707796d12d6907b039c715d1
- SHA256
  
  f44cc1e23d0d192dcfd84069b27704cd0b2a8e7720eee43656f57cb474433762
- SHA512
  
  4a73be7228960719236f39abc6dba7741498d3a3539f7bcc31b6d28a2574e41e4f85e6c2e0fbcffe9ba3b6a646fa3fa078adc0a53c46a4676b871fb92e11fe4f
- SSDEEP
  
  192:wWMcTgQEri3hPkpzRK7KVM6cqm+saSLysnlsam4oIWa+W8:wWpTgTu3ypzRo61mVag9Jm4oIWa+W
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral10
- Target
  
  WiaExtensionHost64.dll
- Size
  
  11KB
- MD5
  
  5d084613c0e5c8c3022d9e0f316b0e23
- SHA1
  
  784dd38d9e553eb4b8955320fb596ae4e6854f23
- SHA256
  
  07bc4dc48d5d9bcc2ce52ca8a0f925ca021092dc34cb811e183cbc0d32e576ba
- SHA512
  
  263d3de392b5a4e40e9fbd791062b2731f27410e977dbdacb61810d1a1c2cf24658d8abf5d09a99a18ff7a87c122d9b6744d40723c1637621c5feb327fad752a
- SSDEEP
  
  192:A21YiMppUPSz/pO6IsVTHzdZpCIdglelWWaCtW:AviMppB/w6NTTbXlWWaCtW
Score

1^/10
behavioral11
- Target
  
  client32.exe
- Size
  
  117KB
- MD5
  
  1c19c2e97c5e6b30de69ee684e6e5589
- SHA1
  
  5734ef7f9e4dba0639c98881e00f03eea35a62ee
- SHA256
  
  312a0e4db34a40cb95ba1fac8bf87deb45d0c5f048d38ac65eb060273b07df67
- SHA512
  
  ab7240b81be04f1bced47701a5791bbeedcba6037ee936327478c304aa1ce5ae75856ca7f568f909f847e27db2a6b9c08db7cc1057a18fab14a39a5854f15cba
- SSDEEP
  
  768:mfVZl6FhWr80/Lqar2pe/KLKFKcMkuNr2pe/PNKFKcMkM:m70hGTqaee/CIr4ee/VIrI
Score

10^/10

netsupport discovery rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
behavioral12 behavioral13
- Target
  
  comcat.dll
- Size
  
  10KB
- MD5
  
  835ff05a3f5e16e0fe41e515ea398bd4
- SHA1
  
  e025cb17bbb01a1b5715ebbc745272a8611dae6c
- SHA256
  
  8dcfb1e6aa965df4bd4c0551d03bdfd6472c80219ada4671910958688fbb4ab6
- SHA512
  
  e6a7002316b05759c433b3e0516843a14199ee4b23315d799b533a52f9932f4715fc8aa5fae96892901ac67f0dae6d239eb37fc722558cb7c9dd906564719cd1
- SSDEEP
  
  96:j6cuh8B0DNcU2QD6SNkdSWn+smK/4W70ADlqNXEWPT0lF+WwUL:jLuTkDSNkQ+h4WoADlBW7a+W
Score

1^/10
behavioral14
- Target
  
  getuname.dll
- Size
  
  11KB
- MD5
  
  91c68038bfc064ea8fb6d432acd38ee0
- SHA1
  
  4df7e33b6e325f31231eaaab366e2e710955babb
- SHA256
  
  68de057c4175d4c94afa2acb2abc1a9ccac04a3ceb8e84c33f7f414bb8b0eeb6
- SHA512
  
  002aef67593058c88b980a4107f1ca4ddfec5268456f76d1d358179e00ea2a0cd64c93fb31a7e78055885cfd508c90a7b19c6c6fa7a5a3c3ffa305677a0955d2
- SSDEEP
  
  192:f3emo46V4w9263FeVpszrEc3YDtmWIdW:Vocw99e8YRmWIdW
Score

1^/10
behavioral15
- Target
  
  ifsutilx.dll
- Size
  
  16KB
- MD5
  
  27a7213091cda31e84967bead4d29bd1
- SHA1
  
  e705e0fd25167c8cdaf984f067e3bdf4be8558d3
- SHA256
  
  42214053995b6188b2e20935ca8c92af77639f0d5541a132920a5cba2cfcbde6
- SHA512
  
  a16ee540cad2661f3d31071aed3b2f30ea5c0f068f51a350ef693fb83df30ce97ea4701714091ed0ef4a0806d908d93691beb0d8060b5ec73f62422477c8f3ce
- SSDEEP
  
  192:peIxDV4pntj/Hi3SbYMS9HERLChPjuARtNlvJy7VfYN7EcX2D1WsZW:peIxp4pntja35JExChjhtWYNZ2xWsZW
Score

1^/10
behavioral16
- Target
  
  mprext.dll
- Size
  
  13KB
- MD5
  
  0eabd6ab464758f058fc039a47f61750
- SHA1
  
  51bc562a59e565e3f39a54e4c788896b8803354b
- SHA256
  
  f96e8d99b736e4ce7997bb1de65d88c32e16f1f725d8bd98f52c39a02969fd87
- SHA512
  
  f5a038615ecbb72072ef2a72d166cabbfd26aa879f28c911a26db71581cb8b93b7554b1cfa1517b063fdc5f942281e7d409e70c998b8273fe9ee6a0fc61a00fb
- SSDEEP
  
  192:t2sVilvoSG4X6ryFKdEwFQnuyfc38EcX6mWf3W:t7Vilvo74XAyOFQfc3U6mWf3W
Score

1^/10
behavioral17
- Target
  
  msidle.dll
- Size
  
  11KB
- MD5
  
  b1c1bb1ef2ac2d739aeaed77c33c1848
- SHA1
  
  efa181a1ea01e02cd44614f80259ce794b7a455c
- SHA256
  
  cd8d7caebfeb4eb9124ba3e025aff68dde554a8dd6b3365654bf936200c4e563
- SHA512
  
  f4e24c508248e6f331aa16ed01c7cdc6cebbc4cd09dfa9f511d02544e2c04eb36c9480ae71d9ddef039a1e9d6e0324179a9ba0f1c323e20c4bbf813a154e2fc0
- SSDEEP
  
  192:PtHC6MRyx1TTmcWOznzYuhcGZtEclABY5Wx46QuW:g68yx13maLX1ZhAa5Wx46zW
Score

1^/10
behavioral18
- Target
  
  msidntld.dll
- Size
  
  5KB
- MD5
  
  504e51418d856d664db23dd55a61352d
- SHA1
  
  522c0fb1ed2b9594e7a2aab9481883da57d8ca23
- SHA256
  
  f190e142f402de460455ff2d1835294a3e118ba74d76aa092af49372bb9b76f4
- SHA512
  
  28bebb26eeb8ba97fb0ac8cc4869576d3cc58cd7c0fdce988f6fe160c7b426c2a3906799ca021a65a26394cba266dfa3d3e58790ec41c7eb7ecd0fbd89d6e0db
- SSDEEP
  
  48:Cc9m3IIuHkvrQ5yHqO2JsYa3yBk2lFIZWxHtNukt685WwHg6ab:Rm4ZEvrU/bTaiy2HEWhtDdWw3
Score

1^/10
behavioral19
- Target
  
  msvcr100.dll
- Size
  
  755KB
- MD5
  
  0e37fbfa79d349d672456923ec5fbbe3
- SHA1
  
  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA256
  
  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- SHA512
  
  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP
  
  12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  
  neth.dll
- Size
  
  2KB
- MD5
  
  26bf659dc283cd389baad0ca54c1abca
- SHA1
  
  b386c4c9400880ec8315a93af0c5b38db6be9abd
- SHA256
  
  ad2310e7f3ba73c29872a14826f6a5118765a4c6b67a57168a336c05365dd152
- SHA512
  
  871449eb6b24a9d13134ca2d45f0839a2a417517969d1c7029219570aaee932e27026b29987553d41c58c13f265cf2a406442e21db54a07fb2555392cc4bf19f
Score

1^/10
behavioral22
- Target
  
  netmsg.dll
- Size
  
  2KB
- MD5
  
  176e3d19f665faefd5c5f892cb310ac8
- SHA1
  
  da39984d4f8522ae694cb310a64282f150aa3b26
- SHA256
  
  6ff38f25cbf31af03633654469c67024df13bf59b1ed9fa29597c4d6cc5a624d
- SHA512
  
  4cacf6f1277a563ae80fff86c277580d9d570a53ef75ca7cd27e63bf33c2d0a4795eeff0696cadfec619018c6c9fd1b9f023ce7694e3a847e534cf7a24a8a19f
Score

1^/10
behavioral23
- Target
  
  panmap.dll
- Size
  
  14KB
- MD5
  
  c3f21a1cc9dc3cccc38491da27273f11
- SHA1
  
  b59cd05fa587eb37993e87359d26a9210beebb01
- SHA256
  
  cdb271b988bf3dc272ad93c272c446efa981c93fe19b7cbee8d2f01fb058a005
- SHA512
  
  a0d882bde23d545f37395311639b78123a1108c022d866d86fb449992387cb7e53fa4b4a54c0e53d74c3e31a9220a9e15a3058158df851cf598bf7e520b3e7b2
- SSDEEP
  
  384:fRGwUPvXMv34d8TCw0Y957Ua8ZHgDITnWNaW:lOKT79BUFZHgMT6
Score

1^/10
behavioral24
- Target
  
  pcicapi.dll
- Size
  
  44KB
- MD5
  
  9daa86d91a18131d5caf49d14fb8b6f2
- SHA1
  
  6b2f7ceb6157909e114a2b05a48a1a2606b5caf1
- SHA256
  
  1716640cce74322f7ee3e3e02b75cd53b91686f66e389d606dab01bd9f88c557
- SHA512
  
  9a98e0d9e2dda8aefa54bddb3c7b71501d638dff68863939de6caa117b0e7bf15e581a75419ef8a0da3f1c56a19f1b0f4c86d65f8581773ab88ff5764b9bb3aa
- SSDEEP
  
  768:3o6OZSOe0iI6IdE+OPCH4mf6u0Qn+6wwbiRGp9E+yhwBkbp9E+8iROr:3o6mSOqIqPCYmfRnlwwbioQ+yhwBkbQ1
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  prflbmsg.dll
- Size
  
  13KB
- MD5
  
  54fb96ffb3e2984755f82cfff72e317a
- SHA1
  
  e569e22624267b38abfe33a452a1f7657848ea13
- SHA256
  
  73b88e1238ab71ed4142952f06e49d230f611c28ceeac263820f6af148d2965b
- SHA512
  
  105e5353ea3db3c90e5d2a7ad0ee0dea52d648e61c0a34a2ee507a3393ec3c925d15e96eab59cd186ecd2d9322211de886058db88ccd8b6ea706884d0eb632d3
- SSDEEP
  
  192:sW3KWeyBV+b/Es/yppToazeoeWKCS3v4b//kbIFx7/j:sW3KWNiURBajQb3kbSj
Score

1^/10
behavioral27
- Target
  
  provdiagnostics.dll
- Size
  
  21KB
- MD5
  
  81bd7399ef847e73954ae785471ac5b8
- SHA1
  
  3557ec236de42c3c1221898ae1e1dcee3fb40dad
- SHA256
  
  b7eb4c207979e5c4311e8c7553cf478129c5ede51bf93f4f53a99ab63c6029a2
- SHA512
  
  9bc2261001c4483aeed4c19ae089693fc0b220f784813ad64b9cdef97207d78a5d9b338ba85f8dc99752d87d4b4d73f90bb9db95cd16084c81ab8a25c738255a
- SSDEEP
  
  192:dp/gBLEz6cNFD34trWzWWriOsEbaDkwJJBR8Hcote4ie1dEs9oUgyq2o/6H:d1gA6kQrWzWWOOsEbab+06D7M
Score

1^/10
behavioral28
- Target
  
  remcmdstub.exe
- Size
  
  67KB
- MD5
  
  62cb7909b5247f472b0e3f748faedf35
- SHA1
  
  f424005eb21deb09f1617f33814d6e6c3851b7dc
- SHA256
  
  f6aac87863a73299b260315748cb0bc0b964d860cf5710993ca54bd79aaae5db
- SHA512
  
  2f4e36f6a0718e7fc9e08e5cca13b76089cb6c42ab772475a2fd68128268e3c0b6c6371ea665b793a8f6bcc3da76c6a57cb0b916d1d8b71c47d603933a7d72c4
- SSDEEP
  
  1536:gfanvXuNOwphKuyUHTqYXHhrXH4xLIyGMoGPriPWvuPVWXiD:yanPSpAFUzt0xLIyGcPrmGuPVg2
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  wiatrace.dll
- Size
  
  18KB
- MD5
  
  2bdce845c9ab1d3eb0020b8e74c536dc
- SHA1
  
  2d9745fb19b3661d7bcea9b06cd2611d5b5ca80d
- SHA256
  
  9ad91cc28cbc6cb010911427a9b3d406a193d13f05f85e58ed7af01e8d9e3b2f
- SHA512
  
  321cec721eae62374384b82f092ff609b5ee48746d3a7839e20c098a40439f0fdbea1555922dda1e42ccfb1e28ca54ef6a0157016506f3ea8dc504db0e1f8f29
- SSDEEP
  
  384:5M+6Ivvr4mUbaRVa8snJ3pPeCm2Du1EyjVWq/W:cuJoWC/KuyT
Score

1^/10
behavioral31

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Netsupport family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31