Overview

overview

10

Static

static

7

AudioCapture.dll

windows7-x64

3

AudioCapture.dll

windows10-2004-x64

3

PCICHEK.dll

windows7-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICL32.dll

windows7-x64

9

PCICL32.dll

windows10-2004-x64

9

TCCTL32.dll

windows7-x64

3

TCCTL32.dll

windows10-2004-x64

client32.exe

windows7-x64

10

client32.exe

windows10-2004-x64

10

htctl32.dll

windows7-x64

3

htctl32.dll

windows10-2004-x64

3

msvcr100.dll

windows7-x64

3

msvcr100.dll

windows10-2004-x64

3

pcicapi.dll

windows7-x64

3

pcicapi.dll

windows10-2004-x64

3

remcmdstub.exe

windows7-x64

3

remcmdstub.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ns.zip

  • Size

    5.2MB

  • Sample

    250206-w9m63ssra1

  • MD5

    f8a1897cfdae396dd5e3dad215336131

  • SHA1

    2f0c56ebd76ce4a36a989eeecad5368b45287c88

  • SHA256

    23eae2a9d0bf842640521e8f44c240720220b8fc7fbf7e3121c0f4d0c62bf2b3

  • SHA512

    c85f3847905defe63b75beceff313afde8cb6b58c17437cbac2d1a2529ca5217e8ec81238424ee277939028d3096e7845becf922bb218e9438c6d724cb400827

  • SSDEEP

    98304:u11OYBmPlAH60o07WZpvM+X1d05smow458rdxYEpJ0yAi7j9GLb4quFSLc:u1DBmPyv7WZuM1dGRIiRTpJ0yAiCeFS4

Score
10/10
netsupportdefense_evasiondiscoveryratthemidatrojan

Malware Config

Targets

    • Target

      AudioCapture.dll

    • Size

      80KB

    • MD5

      b24bac29892fcfd50a0ad0901f05f253

    • SHA1

      cba57b8656affa77fbd24358c27accb3817c89ef

    • SHA256

      49619a2100bf1f0108eea8e8d571b33a784d5c10e769b41225f497fd19ab1ace

    • SHA512

      e2e0a20309e4e488e47be12d4c7413e49aabcb4a833f7ab4a8191c1a3cf0579b3a68986f5691d1daaa17d701ad48d9ecf053a78366e66120b78310dc233a8bb5

    • SSDEEP

      1536:s6Y+3bZm8/vLk957pyPkD/bFRFpmPcW+gee/GjHdee/QjH9:s6Y+rQ8/Tk9Rp5zFpmPl+gefj9eljd

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      PCICHEK.DLL

    • Size

      31KB

    • MD5

      13661c770af0008be7b07b5e8727770d

    • SHA1

      614e73b424618c5171a69041eb85da9948c6600a

    • SHA256

      e4793d1de2aba7c1a6c9d5ee2c9dd7f77e6d72f795e3a6fee952cc01795eacd1

    • SHA512

      52d80ae4e01e909c074d8c934ce94ccd53da3fc0cebeea8aea48c6b3889c98101620a113298fa357a0f421742cc483dead3dd85b701252b070f565fe9b196ecc

    • SSDEEP

      768:l52mnrr2pe/GJvHDHf/ckApr2pe/GXHDHf/ckZ:rPnfee/4jHE1ee/6jH1

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      PCICL32.DLL

    • Size

      4.3MB

    • MD5

      6a8b46d540d96a991cfe141bd60b3def

    • SHA1

      6c8ced9543300fe447c1dd2a087bd2fa06e36b5a

    • SHA256

      666fe72e982876e732736b410cd0766a0c713293e38424f94f472486876e75a9

    • SHA512

      cd64f1557e3247bfe290b24ae61890dd5265ccdc1e7a9baa493eb32c75c80fbf7fdb118803b86b2b57151df4f96c28be4b1663adf2b6d1271dfbe36899fd164e

    • SSDEEP

      98304:UbnoAxfwBBnO2Yriq6QtwKPXiJSHe/EXhGGqaa8hlFCS:Ub/xfwBU2wBhPiw+cXhG3aau/V

    Score
    9/10
    defense_evasiondiscoverythemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral5behavioral6

    • Target

      TCCTL32.DLL

    • Size

      459KB

    • MD5

      8b06b1712d744556a67b8b727280676d

    • SHA1

      635531af9084cc9d46a631e7fa57a75598e74051

    • SHA256

      c4a67983aada7bf78182766130d7f34bdb682bbba909d791c9dbf11e3311f304

    • SHA512

      0a5a7dd3f895d8cdc2a5d3e61241bf2b2ab11574a39d7faac52ef9c83b61c46d375164a1b9076ee864f436fa1a1fefe5345176ff2baba6ba11f955335229230a

    • SSDEEP

      12288:D+MEmCOirSwXCHVs5QroHNgstVJ9lf8Mu3qyPKLfco:D+MEp5IsV4Mu6yPKh

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      client32.exe

    • Size

      117KB

    • MD5

      94f621ecfc000054e03cb7cd5fec536f

    • SHA1

      9fb3595b0444da81a7c0e89f2b447c1d37c129c6

    • SHA256

      2f42b24bf5c1dbcc776a98c2f77d5495c42956f82e1cd397693c28e4584e511f

    • SHA512

      09cc3e2537839efff9e6233cc3cf3e9b1553412345b023c900775f4b77afd1d7d349f868f9efe3482a8c8c0bf03df8f52ccc6259fc22d98a36fe815da70bb9b9

    • SSDEEP

      768:cfVZl6FhWr80/SqUr2pe/3NSHDHf/ckMQGr2pe/k3wHDHf/ckFd:c70hGaq0ee/3UjHoee/UwjHn

    Score
    10/10
    netsupportdefense_evasiondiscoveryratthemidatrojan

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9

    • Target

      htctl32.dll

    • Size

      316KB

    • MD5

      051cdb6ac8e168d178e35489b6da4c74

    • SHA1

      38c171457d160f8a6f26baa668f5c302f6c29cd1

    • SHA256

      6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269

    • SHA512

      602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36

    • SSDEEP

      6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      msvcr100.dll

    • Size

      755KB

    • MD5

      0e37fbfa79d349d672456923ec5fbbe3

    • SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    • SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    • SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • SSDEEP

      12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      pcicapi.DLL

    • Size

      48KB

    • MD5

      a17e05bb6545453900dcaa2a5230359b

    • SHA1

      7c9de48aed728422e24ae9625a8f37e80f9c7b46

    • SHA256

      37744c725c88ded39e1fd4d664227bdc4fa01187dfbcc17d915600fe9956cb19

    • SHA512

      56acfa5693883a313a718e04e2aa32dce8e24d42f19a4a8097e5fd36157b56ee1fae45b636015145349ed1af2e068c95f9d15b6bc8b91834fcd63f71be2600ec

    • SSDEEP

      768:35GznfNnu0sbqmuebcTYCBU1wn+Pam8Arr2pe/PZD9HDHf/ckDr2pe/sOHDHf/cD:35GzfFDmmTYCtMawee/zjHjee/VjHa

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      remcmdstub.exe

    • Size

      75KB

    • MD5

      fb22ad988069b1e19de084d55cbbb72a

    • SHA1

      b2af50ebe0fd53ccd26f28161272585423522e11

    • SHA256

      117553d99a04e6487216803e44e33dab5c3a4b01151bca7b76a206ce7132cd57

    • SHA512

      5d9493afb78fd271e836247a80dd42a181f343501e2e190a508089f02f4ffc84f25a4884fc85018c1f6935191688d8af0e7c24bb16995a912d75de7398841f69

    • SSDEEP

      1536:OfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/hjHSee/sqjH4:IafLSpAFUzt0LLIywYeAjyesjY

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks