netsupport | ab299c3cf0dddff7283a2a96bd3f4610add08177793a2cb047255a5da5731d1d

Sharing

Copy URL Twitter E-mail

General

Target
Broker Carrier Agreement.exe
Size 30.7MB
Sample261020-v95kpas1bz
SHA256 ab299c3cf0dddff7283a2a96bd3f4610add08177793a2cb047255a5da5731d1d
MD5 63c0064aad0fc46048061d37a3304730
SHA1 d1337fe6400d707543f4c055c00aeb6e6df5c48b
SHA512 74ac2df52b6c67864e179a5c7b4767b3e168518231282bd3d6e0faa9ea3f1033b467a435be006d0863d5aebf6a2c9643ba77258a4099d808d7fa219c54a9d1e2
SSDEEP 786432:dfcdGhoDHd5Zy42qNG+c20xj5PUimV4389fmb3a+69Uo6c:dfbc95ZT2DBxp662+bK+qUs
TLSH
T14F6733074E4DEC92F21095704B422ADA96EACE3317ACF9DDB55B3284FEF9E8111C065E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Broker Carrier Agreement.exe
- Size 30.7MB
- SHA256 ab299c3cf0dddff7283a2a96bd3f4610add08177793a2cb047255a5da5731d1d
- MD5 63c0064aad0fc46048061d37a3304730
- SHA1 d1337fe6400d707543f4c055c00aeb6e6df5c48b
- SHA512 74ac2df52b6c67864e179a5c7b4767b3e168518231282bd3d6e0faa9ea3f1033b467a435be006d0863d5aebf6a2c9643ba77258a4099d808d7fa219c54a9d1e2
- SSDEEP 786432:dfcdGhoDHd5Zy42qNG+c20xj5PUimV4389fmb3a+69Uo6c:dfbc95ZT2DBxp662+bK+qUs
- TLSH
  T14F6733074E4DEC92F21095704B422ADA96EACE3317ACF9DDB55B3284FEF9E8111C065E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport sectoprat persistence privilege_escalation rat trojan
- Detects SectopRAT aka Arechclient2
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Family: SectopRAT
  SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NScurl.dll
- Size 7.4MB
- SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
- MD5 db425209aa38a6f6d8379f441b99950d
- SHA1 951baa838310b9352dc9f8923ea7ada206efab94
- SHA512 dd96e9ffb4c38bb3826ea0c178b9bfd71d38ce6d9f1887d3262c4ea8313049d2ba7b9a5279980d8981b8cc49929801e02ccd5fe48dffe7a787e9cff658592741
- SSDEEP 196608:gfb4qtMPEdoSlT5x4Ww4EbEEW7IDqlcT1VuDx7Kk/fcHLKoW:WqLK
- TLSH
  T1A1764A94FECB04F1E55784B0D8EBB37F8B34A7118125D6BAEE0C1E56F933701261A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  app-runtime/DLLs/IronPython.SQLite.dll
- Size 629KB
- SHA256 fb87b114a989fac71ee047f9a528b555a0fa69d4a74d17b7b587cbd6bbd94acc
- MD5 fb3e0d62dac3724f25ff7bf74303e150
- SHA1 8e151fdba2fca83ada22c40d13825803257acc01
- SHA512 6666caf3b89f989de29fe658a4255e7539c9751c50ce6ce9feb7d3f444a68f49be804eb509ed2941f9d2549d6ebeb3156a9fc88d7dfe79db67721e1dea34ff0c
- SSDEEP 12288:znzEx5XFUMGmq3aRyGq0Lq24SyIX4Zah:znz6FUMsbhwyIoU
- TLSH
  T1BDD44B7A6BC82923E5FE5B30E0201D5943B1F015DBB2FBCB9944C1B62867790ED647A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  app-runtime/DLLs/IronPython.Wpf.dll
- Size 7KB
- SHA256 35e434d4bc103ab47ab1441051538cb34c7600cafc5c89f96e9f3456bb5d2537
- MD5 ad8de7f7c3dddff0f39ee59a99c07d54
- SHA1 12922d887e774cb8630f74904970ff69b6dd6cfd
- SHA512 76896e2402bf1792ecdbba6a25d0f0d6fa47716b577852b0d14692e0173c4ecdad6a163ea8fd4073ab22926e3c256222951ca1ed74a636add68696967fe72dec
- SSDEEP 96:TqhD+g2FEPEAj+U1cZY7ECPt4/FpK95rNZHRTGucQR12i:TeD+5FEcy+acOWFg9RTbDz
- TLSH
  T1A9F1C872F7B5063AED7F0777D8B7164442B0A6029863EF2E0CEC81872C6915496727B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  app-runtime/IKVM.Reflection.dll
- Size 396KB
- SHA256 0718c32f2184fe2b177a9f1dfadfcffcc2c1755de84f659730ba237e13339af7
- MD5 2ec8b6f478e732d34f6458b47cc83016
- SHA1 9d833125c1b4fcae8b49c8deb13d681d0bbc63f7
- SHA512 6ad6a512471702967e67b76075ef7e458500a7ec6a3da08841d8108ed287b1f9a20144420303ef95d12910f5318b3a7e8051e35f947732f3910cd281d2e366aa
- SSDEEP 6144:ehLd0dqmZ1kDT71h14P8pUykhHGQppTIeAg2J9Q2v8DV0WTXVYXFdm:eFd0dqhfB3CykhmQp9kOV0WTVYi
- TLSH
  T1288459146BFC277AD88E8372F4A24C2853F5D22562DFEB8D8D88BAF51C57B509C11623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  app-runtime/IronPython.Modules.dll
- Size 783KB
- SHA256 ceb8f979454511cfbc0e418139a3874dcdeec86adc1ef27122f8af61c2f3af60
- MD5 7e98a6056c2978afe12e38eafa99be0a
- SHA1 899787e7666cfaf65d3a2651f7a2f07bd5a46b03
- SHA512 270a6233f6703bd5e56768aa30bcc8fa3ef02b700a696036226fb6c2e635b32e083b058f86a136128e83680104194de6722b21cacb984dd8b5b019026c51ee63
- SSDEEP 12288:JwNw4zDMDLJPcGOevRSUJvrms0hZ8st7Tgx5aIvcXUgKDI9Bd/WN:JSzDMD5vlvRSwr0tngiIQFEN
- TLSH
  T129055A1677E85B07D5FE5BB0A4380A684370F812AFA6FB5FA84495EE1D927818D007F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  app-runtime/IronPython.dll
- Size 2.2MB
- SHA256 781b795b614a46596268c3742b0467519950d928407852df18bbd7b3b9f07871
- MD5 81b3c3ecb4166e78dd2eaecaccb3b738
- SHA1 0bc2d0154feb7dac6cc7ea38ab754a7f7c50c3c3
- SHA512 2be80a85155c6ba9c0dcff73ad4fcb4bfae847101ae58d93b4525f23613f58bc4862b28cae0c5496ff8af792f2f30fde89fee58bed21717e374c82affa28e520
- SSDEEP 24576:j+B0VRHr2Tdsters8K6U5v74EZoZjw5YoHH0tyPNgfo7zPCH+:jc0DidsYrrK6AXoZjw5ZNggnPC
- TLSH
  T19DA54A5137F86E17E4BF8734E0B1902497F6F86A6B93E34A7609A6B51F923014E413E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  app-runtime/Microsoft.Dynamic.dll
- Size 832KB
- SHA256 5810727322dfed8919dc6ff1e98d9c123aff04de2ec92cef516b648f2ff97294
- MD5 c7a9e8c38a08cf992b86921455801a0c
- SHA1 99fefd4769285d796a6b8bf66fc966d35a195f60
- SHA512 7cc02b4d77c912925d8bc098e62f72acef7e6e316fbb5119d6fce357c41d8d887d4257bebac9cef36c4a519683acb050e06ea6da7fc9c556d871c9d9f8629267
- SSDEEP 12288:XDPS7ulgnQ0bA1bp+eog7khhWhhWhhI6oD9zBqR+:TgupehhWhhWhhHoD9c
- TLSH
  T15D056D4233D8DB5FC6AF9775B4340A2853B5F546B2AAE7AF64A0AAE40C833104D547F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  app-runtime/Microsoft.Scripting.dll
- Size 142KB
- SHA256 f1aefa13b2879eb883027c22e0c72976e34d88a95572588de77de3716d9a573e
- MD5 6084eb0af148d2150146752a8c06c1a0
- SHA1 c3427a546e0e1af230e10790e3cb12151a86278b
- SHA512 38880018d57eb4575e7abbe3794a6c0b5d868ee58c3953a6c1b592442a553cec86fd6981fdbffbfcdef2c5ec0f94050629cc849e72f88562603e4a7bab46a349
- SSDEEP 1536:pgg/O0lPQeGGQhcj8EP3gQ4D9PlzPunMy3EoVqie173nRw+:pTOiGGQh8CDjcMn6e1Tn7
- TLSH
  T140E3274527E88A2BEEFF1A7EF07106140B71F91BA537E78D1954E8EC1823B908952773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  app-runtime/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  app-runtime/System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  app-runtime/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  app-runtime/System.Runtime.CompilerServices.Unsafe.dll
- Size 16KB
- SHA256 66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
- MD5 da04a75ddc22118ed24e0b53e474805a
- SHA1 2d68c648a6a6371b6046e6c3af09128230e0ad32
- SHA512 26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
- SSDEEP 192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
- TLSH
  T1CD72294A4BA80313ED736B309AA4D443FE38A7D75812D72F1985F1B91CDB7D4AF21628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects SectopRAT aka Arechclient2

Family: NetSupport

Family: SectopRAT

Creates a file in the Startup directory

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32