Overview

overview

10

Static

static

3

079a241c68...f4.exe

windows7-x64

10

079a241c68...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cb7b527eab51eb099095e6c6d27258c0582b8dfabbf6c8d1c04f97470927b18.zip

  • Size

    1.9MB

  • Sample

    250325-mr1j1svvas

  • MD5

    1bb1125a883383fbffed5681c4ec7fa9

  • SHA1

    c319e19901137b716f5f92f1d276eb8f40373e96

  • SHA256

    1cb7b527eab51eb099095e6c6d27258c0582b8dfabbf6c8d1c04f97470927b18

  • SHA512

    701be6615ce517a2fa2fb819e5b6b9c542231046bc346ef4d0000f30288e4806278a7fb087b949e716cec78dd06c6e92abc61b2619703fc57dd86b5fadad7898

  • SSDEEP

    49152:CVgIs1owVmllAoSgna+vHcZ/S71FZR6zDztC1OIy/HeMl+bS:CeRxmlAoja+v8uFZaDzo1XUMu

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      079a241c6823b3b60bc10eb136434853d48b552a2d274fa43df6c493e01b64f4.exe

    • Size

      1.9MB

    • MD5

      faa6de8d4af45c2dc8280bd6add77210

    • SHA1

      62b0f52d1d14f5cb744fe3dbe2a08e222a07e1cd

    • SHA256

      079a241c6823b3b60bc10eb136434853d48b552a2d274fa43df6c493e01b64f4

    • SHA512

      cfab0bc6cca48520a8c6353853719e420aac0ac395b1612ccd1834f62fd90b5cfebaaa02a00eb342505446c775fba30d843d863208b97c87e97bade7a04fcf69

    • SSDEEP

      49152:9deRglK/V+UA15JEKnBPEDY08BTGvSNESvgs:90RH/VxgEKneY/BTXNESos

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks