netsupport | fa33f0af6511c3e0023d4960fb3f046a09c0e5ae6261d396789baf147ca328a5

Sharing

Copy URL Twitter E-mail

General

Target
NS2H.zip
Size 2.1MB
Sample260701-pergpafx2z
SHA256 fa33f0af6511c3e0023d4960fb3f046a09c0e5ae6261d396789baf147ca328a5
MD5 615ad361f5523a858cd2081cb6c718f9
SHA1 84b98f1c39c88d5ede133854dfa6a51b5cd82452
SHA512 22480d4be4fd47d7eb1a866f854b99f1048a13dbd7f832879092f27ee90ba2e38c7615cdbf2e4b7e5bb61b73477be17daab50462239090b7ad66528e7e6d1f74
SSDEEP 49152:yDMtGEdbNpje98aVxbGBPrQUUSBhdzZYnir6iOUyfA1n:LGEVeh3GBPF3rGUdZ
TLSH
T1EDA533A0216DE17CF96B78BECA6A91C8473C2503315AB313F5BA0CC96F46E616374EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NS2H/PCICHEK.DLL
- Size 31KB
- SHA256 45532e8ecdccca684dd3b492c58485b0b2987893f5c7a3590c60f5fcaec4a27c
- MD5 0f013074107174edb0b6865e165e93fd
- SHA1 911b8ab198517b72ec02ea4c788adb7ec89bb44d
- SHA512 e7f9e4fed954f2638ef2bc221d85e57d471e14a9091559a7344b7432290c59ca26f8a3ac1b68e54bd6e20d9b22232d1d7d3bfd7bdfbfb9d5c2fa36eb62492ed0
- SSDEEP 768:H52mnrr2pe/GJCHDHf/ckhApr2pe/GlHDHf/ckdO:ZPnfee/pjHi1ee/QjHhO
- TLSH
  T189E25C562F781153EF968FB8A0D594072D7CF6829DED908BA01787192E083E13F6872E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  NS2H/PCICL32.DLL
- Size 3.3MB
- SHA256 adc7aeb96dd4c244afc5b354b0100d29d224e3b8a71e88afa281df4be56c36dd
- MD5 e2fa97f0a14465d05004433608ff7218
- SHA1 6cd8f5d8229934a098bc51ab22e60936bd2f22f5
- SHA512 eaeb0cfe95986e45ec14c98fcc051afb58ffb8d846e5c1568ea0fe74834b7cbd7c6f655d363533dce26f90b9e35a122d75a2cedf2a2d196978dcc6e71c2189e9
- SSDEEP 49152:SOelFBtdIVwi6FXg334cdqfs5Q9DTroaEclSTNHAZ370q:SOwFBte6BgHOE5gPS1AZH
- TLSH
  T11CF51832E500C831E1564079DC7E6ADC851A2DA01F1885DF659EF9AE2EF23C533B8F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  NS2H/TCCTL32.DLL
- Size 459KB
- SHA256 d03c41b7f46ef897fad02925251bdce78f1079bb7a1aa2f853704fbe81f759d1
- MD5 684abef8ba635a70a2d0a1ed5735f903
- SHA1 f91829260511f36250f9e248e7e5f9588a76c1dc
- SHA512 9d7837201ef48c54def45c3874eb6a021ee946e0de928466f128c87f534253c1b80ffa5e49d44db7df245fa3985d3c36384de469f3fa3d39d065a09abef26c13
- SSDEEP 12288:Q+MEmCOirSwXCHVs5QroHNgstVJ9lf8Mu3qyPKLWD:Q+MEp5IsV4Mu6yPKQ
- TLSH
  T1C5A46C20BAD08132F7E61678CABD9BA51D7D78611B39A0CF53D4586D2E207D2DE38327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  NS2H/Updatesystem.exe
- Size 117KB
- SHA256 46c40af9624ba9be8af28cfc7d3847552a93089b4b4db07a66547081f29f9891
- MD5 ac0f52907a6c7bf3449d36b4507b0e6b
- SHA1 8c679ea122e9b94ff37dccf6ed251346341b26dd
- SHA512 942b07999b717f55a086b71247f4b6cd0acdf1e261fbf20614e81c410f46e293a22d02a8b66e0e1b55c3f92b9bf1ea338784dd81923210b9bef042d297f005ed
- SSDEEP 768:LfVZl6FhWr80/o4Ur2pe/3NEHDHf/ck+fGr2pe/keHDHf/ck7:L70hGA40ee/3ujHjee/tjH/
- TLSH
  T168C3B44F469DE173EA42E97CC4819B050DA4BEC9B8B458FB005EF63E3E3178E2B5415A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral7 behavioral8
- Target
  NS2H/htctl32.dll
- Size 316KB
- SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
- MD5 051cdb6ac8e168d178e35489b6da4c74
- SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
- SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
- SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
- TLSH
  T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  NS2H/msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  NS2H/pcicapi.dll
- Size 48KB
- SHA256 a580826b0cdd59387b77f41015a2c54c8bfcdf359c0edc72993a50299918f404
- MD5 394fbd2ae1a6cb460f27d6ff7badf6fc
- SHA1 3574b44482d2fcf61d09d54dd777e9184e171699
- SHA512 b052a4ed0662b21737840e4aaf8bfd8df5200439e8b533588c080a7c8779476740f4c378dc76c16f6717216b1785c2502c82f1e78245cda1eaa6f30ea3feed2c
- SSDEEP 768:3YGznfNnu0sbqmuebcTYCBU1wn+Pam8Arr2pe/PZDXHDHf/ckMr2pe/snHDHf/cO:3YGzfFDmmTYCtMawee/BjHgee/wjHrH
- TLSH
  T1A2238D82BAB85153EBA24DBCB4D599036C7CF6B25BEC50C7B107465929093F23A7831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  NS2H/remcmdstub.exe
- Size 75KB
- SHA256 3f9cdacaf03050325aa554e4f7bc769ce2fe9554a06237a1ec8a191bade0bf18
- MD5 f6c814677ed4db067dff7fc05384e861
- SHA1 fb5d0b63e038874533dce2716195cd3f287584e1
- SHA512 f7dba13927573fdec5987b55cc898b9b3e968ad211493d7eddb4961e3fdc921870b3204e828bef5b1c63739aa3953976f2a7b437ad51dc7c267454e5b309efff
- SSDEEP 1536:rfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/fjHqee/sFjHke:LafLSpAFUzt0LLIywYeejKevjN
- TLSH
  T102738E163A65C033EA424D3464F8D2635E7EB96349F9908BBB58077D1FA03D06F6873A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Family: NetSupport

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16