Overview

overview

10

Static

static

1

490ca0c3f4...cc.ps1

windows10-2004-x64

10

490ca0c3f4...cc.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    490ca0c3f440c86afecfebcfdbdc368d5667bf8adaf99e46227d90b9085d07cc.ps1

  • Size

    3.6MB

  • Sample

    250417-ef2c6sytcz

  • MD5

    43038a5dc168bab1073df4ecb1a7b45e

  • SHA1

    52a390c3c0e35155f8514ce80dd3cd8f305079c4

  • SHA256

    490ca0c3f440c86afecfebcfdbdc368d5667bf8adaf99e46227d90b9085d07cc

  • SHA512

    66db3b0f3c76e2ae4e107c489f0993fb749f0048f1587f2f8a461c9af4fc70509fbe8cf281ce4a9b7237a39115fdd6c9f870c7dfd615605b1505f244818fc5d7

  • SSDEEP

    49152:mtHPrielvq+fwU5W95TFSDqAoCqpQaTLBxkMnzlhfX0P2nyMVNOPk:N

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      490ca0c3f440c86afecfebcfdbdc368d5667bf8adaf99e46227d90b9085d07cc.ps1

    • Size

      3.6MB

    • MD5

      43038a5dc168bab1073df4ecb1a7b45e

    • SHA1

      52a390c3c0e35155f8514ce80dd3cd8f305079c4

    • SHA256

      490ca0c3f440c86afecfebcfdbdc368d5667bf8adaf99e46227d90b9085d07cc

    • SHA512

      66db3b0f3c76e2ae4e107c489f0993fb749f0048f1587f2f8a461c9af4fc70509fbe8cf281ce4a9b7237a39115fdd6c9f870c7dfd615605b1505f244818fc5d7

    • SSDEEP

      49152:mtHPrielvq+fwU5W95TFSDqAoCqpQaTLBxkMnzlhfX0P2nyMVNOPk:N

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks