General
- Target 6a0b9e95a235a2f91f56a6fcb4d2e49ac2a6b22459e197831ce7ab63e8455a11.exe
- Size 24.4MB
- Sample260708-thttfadt6x
- SHA256 6a0b9e95a235a2f91f56a6fcb4d2e49ac2a6b22459e197831ce7ab63e8455a11
Malware Config
Targets
-
- Target 6a0b9e95a235a2f91f56a6fcb4d2e49ac2a6b22459e197831ce7ab63e8455a11.exe
- Size 24.4MB
- SHA256 6a0b9e95a235a2f91f56a6fcb4d2e49ac2a6b22459e197831ce7ab63e8455a11
Score10/10-
Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/NScurl.dll
- Size 7.4MB
- SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
Score3/10 -
- Target policies/chelodine.docx
- Size 21KB
- SHA256 50fb94625b7cf2f1274e193751eac260aace84b113bc1d3110a11327289125ae
Score1/10 -
- Target policies/detonatable.docx
- Size 30KB
- SHA256 3e896a0ab0b2a8ffeef5f070e4373818717bdd479b6a7cb686b8e03a578d5ee1
Score1/10 -
- Target policies/gambadoes.docx
- Size 21KB
- SHA256 16437bf88247d066d86928743c0966cfa3874d9216b9c06ed4d852c81f6a7e73
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target policies/resonator.docx
- Size 32KB
- SHA256 5d0ff244a0cdc9fd991d6542c7e7b366aa71e8a4b4f96ceb098f58f9a32687eb
Score1/10 -
- Target policies/swisses.docx
- Size 25KB
- SHA256 279010358d416f1606024a85b4faf5ced124485ba01bbbd7f598e81975d15416
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target policies/vaccinoid.docx
- Size 30KB
- SHA256 33e2b3d504c2ba09fd659f47b114351f2f6c70942e27a60349348a82a9527ef5
Score1/10 -
- Target utils/net462/DLLs/IronPython.SQLite.dll
- Size 629KB
- SHA256 fb87b114a989fac71ee047f9a528b555a0fa69d4a74d17b7b587cbd6bbd94acc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target utils/net462/DLLs/IronPython.Wpf.dll
- Size 7KB
- SHA256 35e434d4bc103ab47ab1441051538cb34c7600cafc5c89f96e9f3456bb5d2537
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target utils/net462/IKVM.Reflection.dll
- Size 396KB
- SHA256 0718c32f2184fe2b177a9f1dfadfcffcc2c1755de84f659730ba237e13339af7
Score1/10 -
- Target utils/net462/IronPython.Modules.dll
- Size 783KB
- SHA256 ceb8f979454511cfbc0e418139a3874dcdeec86adc1ef27122f8af61c2f3af60
Score1/10 -
- Target utils/net462/IronPython.dll
- Size 2.2MB
- SHA256 781b795b614a46596268c3742b0467519950d928407852df18bbd7b3b9f07871
Score1/10