Overview

overview

10

Static

static

3

2025-04-18...er.exe

windows10-2004-x64

10

2025-04-18...er.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-18_f82e57ae2c48e4e647e9ce23ad1d7da1_black-basta_cova_cryptbot_elex_luca-stealer

  • Size

    3.8MB

  • Sample

    250418-c622aazxbs

  • MD5

    f82e57ae2c48e4e647e9ce23ad1d7da1

  • SHA1

    423f29a5d74b2204e41c0927800e479a7e691d78

  • SHA256

    b6edb94c077150e0edec04dfc98e7e01d3a9c49b9128dbdb1e311536029d9565

  • SHA512

    3ee3645910debdba6a21a362b68dc5855943c451586f5e7e6de76894b52f35a43af6029ec4c03d1cedfe1391b6462bd41de6972adb2b6ad65cad761bd710cf24

  • SSDEEP

    98304:xgGF26e7/iEgQ5FqZdTATxV+n32od9ufD+B0Y+Irz7KL:q7D7L5F+uTxVFBfyuY+BL

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      2025-04-18_f82e57ae2c48e4e647e9ce23ad1d7da1_black-basta_cova_cryptbot_elex_luca-stealer

    • Size

      3.8MB

    • MD5

      f82e57ae2c48e4e647e9ce23ad1d7da1

    • SHA1

      423f29a5d74b2204e41c0927800e479a7e691d78

    • SHA256

      b6edb94c077150e0edec04dfc98e7e01d3a9c49b9128dbdb1e311536029d9565

    • SHA512

      3ee3645910debdba6a21a362b68dc5855943c451586f5e7e6de76894b52f35a43af6029ec4c03d1cedfe1391b6462bd41de6972adb2b6ad65cad761bd710cf24

    • SSDEEP

      98304:xgGF26e7/iEgQ5FqZdTATxV+n32od9ufD+B0Y+Irz7KL:q7D7L5F+uTxVFBfyuY+BL

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks