netsupport

Sharing

Copy URL

Twitter E-mail

General

Target

Розповсюдження_ШПЗ.zip
Size

7KB
Sample

250326-q2el3sxq12
MD5

fb370563171d19f01fcfb37efb0c3f90
SHA1

91d8d79f328653df1c21266528fdfe4984af6734
SHA256

d64124d95ae043969ba45775fff878b6550b8a8172fd34388f09bc8d6610288a
SHA512

5c8db529e48e72066485d2544fd7c3f15fd870be750e52c00994a6f1a78f7c1a6d1682a28c631f536eb4bc4b45554be4a5ebe413fb011d71930e0c6662073460
SSDEEP

192:MUN8ZJNfgWbhCr9dy1SsCe2rBc4Tz+dUHW/1VY5:HN8fNfgqc9o1Jh2hFOVY5

Score

10^/10

Malware Config

Targets

- Target
  
  Розповсюдження_ШПЗ.zip
- Size
  
  7KB
- MD5
  
  fb370563171d19f01fcfb37efb0c3f90
- SHA1
  
  91d8d79f328653df1c21266528fdfe4984af6734
- SHA256
  
  d64124d95ae043969ba45775fff878b6550b8a8172fd34388f09bc8d6610288a
- SHA512
  
  5c8db529e48e72066485d2544fd7c3f15fd870be750e52c00994a6f1a78f7c1a6d1682a28c631f536eb4bc4b45554be4a5ebe413fb011d71930e0c6662073460
- SSDEEP
  
  192:MUN8ZJNfgWbhCr9dy1SsCe2rBc4Tz+dUHW/1VY5:HN8fNfgqc9o1Jh2hFOVY5
Score

1^/10
behavioral1 behavioral2
- Target
  
  9e269dbd-c083-4c9d-bac5-08dd5bcad6e7/bc4f23a0-da10-66c4-22b6-147a0f08c223.eml
- Size
  
  18KB
- MD5
  
  ef5e3c6fdab8e400a7601eded53d62db
- SHA1
  
  35638fb07251da93e37eb389e85dba77149ea1f7
- SHA256
  
  390306ba5629829ee982b601f37b3b371f47778eae36a9bd7d8531b26e9b3607
- SHA512
  
  1e1e5acdcc4cfb0444dea9bd5145c839ce763cfafe87eed21a02c27748c24cdd659d232cd9be20903609e9dc81a6e62d65ec8dfac514490204440e0a25b1a16f
- SSDEEP
  
  384:WFdplfdViJyIrRmz/f+uGJhQS04xWfNNqGZ3lWD2hfh:SjsJ5lLBcRbfNHVWD4J
Score

5^/10

discovery
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  
  email-html-2.txt
- Size
  
  2KB
- MD5
  
  131a081fe09813fdae84bc8bb584976b
- SHA1
  
  0f4653c9b8f46029d8207d5ef7c413cb94de5e33
- SHA256
  
  f65e506ef379268ec330500ded97984453e23ea860ddd0355932e0b8ea404c62
- SHA512
  
  f7b6522ceaa0ae051e16ccb864cf12e2b8616e47fee0726812193f7ed1bb96e0b5b1b937dcc2b73534ea9808979e576999fb12ce5dbedfaa33f402ed6a693c45
Score

10^/10

discovery netsupport execution persistence rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral5 behavioral6
- Target
  
  email-plain-1.txt
- Size
  
  1KB
- MD5
  
  8cb00802564c948b0093ec0c5bb43c1b
- SHA1
  
  d54795f4992c0c77267d52d7c8159c64f23efd1e
- SHA256
  
  d1c38a0855260c37cbda24ce76236b53eaab48369257743d0c4a7626b48ca2e2
- SHA512
  
  e16a873d47ce0e91754e30138c6d343f44b067f732065b83893d6aef1b51b94a8873bcf0cc45b8b13f721c06328417cad397d8fec3b63bf943b796b84477ad16
Score

1^/10
behavioral7 behavioral8