netsupport | fcd5efaa02928c1d90172d17e7c8b46115546aa25338b708c6472488006f64ea

Sharing

Copy URL Twitter E-mail

General

Target
NexusSoftware.exe
Size 40.8MB
Sample261105-bztkwsst5l
SHA256 fcd5efaa02928c1d90172d17e7c8b46115546aa25338b708c6472488006f64ea
MD5 fbe9bdf299720f9574e5d0b585d4d642
SHA1 5121c0814867c4e86f4f350faaf6461dcfdb101d
SHA512 9ef01a920617be3e557efb48bd6e710c2db119197241ba02007f28abdb28ce67dcb86c4de01e01a52905f26c6a3aa1d0300c059b737a26adc107835bf627ca8a
SSDEEP 786432:3fn9MtkGFTMBGpJCroIF8bjG1XqKyA/jPoVkn6pbBd06oZ6W+A7ykq5VU6x0C5I:3vKuGFNpsdF8vG1XqKyGoVk6RBnC6W7n
TLSH
T11797336AF32B496FF04BE77C0C154A30DD69CDF8E4ED19295224F8263B3710F9926689
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NexusSoftware.exe
- Size 40.8MB
- SHA256 fcd5efaa02928c1d90172d17e7c8b46115546aa25338b708c6472488006f64ea
- MD5 fbe9bdf299720f9574e5d0b585d4d642
- SHA1 5121c0814867c4e86f4f350faaf6461dcfdb101d
- SHA512 9ef01a920617be3e557efb48bd6e710c2db119197241ba02007f28abdb28ce67dcb86c4de01e01a52905f26c6a3aa1d0300c059b737a26adc107835bf627ca8a
- SSDEEP 786432:3fn9MtkGFTMBGpJCroIF8bjG1XqKyA/jPoVkn6pbBd06oZ6W+A7ykq5VU6x0C5I:3vKuGFNpsdF8vG1XqKyGoVk6RBnC6W7n
- TLSH
  T11797336AF32B496FF04BE77C0C154A30DD69CDF8E4ED19295224F8263B3710F9926689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery netsupport sectoprat privilege_escalation rat spyware trojan upx
- Detects SectopRAT aka Arechclient2
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Family: SectopRAT
  SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NScurl.dll
- Size 7.4MB
- SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
- MD5 db425209aa38a6f6d8379f441b99950d
- SHA1 951baa838310b9352dc9f8923ea7ada206efab94
- SHA512 dd96e9ffb4c38bb3826ea0c178b9bfd71d38ce6d9f1887d3262c4ea8313049d2ba7b9a5279980d8981b8cc49929801e02ccd5fe48dffe7a787e9cff658592741
- SSDEEP 196608:gfb4qtMPEdoSlT5x4Ww4EbEEW7IDqlcT1VuDx7Kk/fcHLKoW:WqLK
- TLSH
  T1A1764A94FECB04F1E55784B0D8EBB37F8B34A7118125D6BAEE0C1E56F933701261A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  policies/arthrozoic.docx
- Size 26KB
- SHA256 18310106d1cddfbbacfaa5a2e4341a11468b5cf657d236a1b015e9424cc5a398
- MD5 cce2a5ff491098285c676ca36bb94ba3
- SHA1 ef7b03a2664680611b2dc903faf0f24a7b8734b0
- SHA512 826dfb3d9c2786dc47cf80dc8e3ac607420340127e9cffa7a24a7dcd17f83c464c8a3daf4642e4c4731f72be8eaf0cfddc40d9f69ea2caee935eba6910c6968e
- SSDEEP 768:VLr9FRa5Th4sn1BlmFAq/BpbI7px2csKoNtRN9VuTo32FPp:VLTRY4sDlmFAq/jrJNTVuTo0p
- TLSH
  T1D1C2D099D94C3C74DA20D1BADAD04C62F46C9817C7DBB5273F1C2760670289A079FA8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  policies/behallow.docx
- Size 19KB
- SHA256 a3b523a01f12c76f9266f534f64ef31675cab65921b51694a8b1bfee5bd26adf
- MD5 1eaaca2ac894ba2d9ed9cd880fa79c88
- SHA1 cbbf8b22a0ec6454673ce64fd3c273b5489c482d
- SHA512 0970d9e32e485c49eded820b56404dd551873e5e33fc0b011a4e03162348cf62f3b16e657d5f16ccf03471cc9d030bc47226b2f841e8630a1418d41fdcbbadae
- SSDEEP 384:E2z0x0RX74oKtxd7jGPPi2YYH6attxcdbyOkHelV9a76QPnz21RFe3S6QIX:E2QxS4oeJjGSk6QxcU3YV9a7x2FP4
- TLSH
  T16E92C0E1D89D9961D025D333F24C21A3F850194782DEFD1F564922EAE445CCB2B8B3CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  policies/brisant.docx
- Size 29KB
- SHA256 77f77fffd7eb6da070d06779a7d21a938a529132a430613262c5ef858e616882
- MD5 77328a9564e2bce1eb9936f89c51d987
- SHA1 e7f91aac1d5c453d20e753a1dc5d3bac8c90436b
- SHA512 cf3acf5405668852e5af7dd8c6e2b2d92d8609c315e023e6995284603112234953ef283220837d70d8a254ccdeea02e385d08c547a806c6e595e36c4832c0fdb
- SSDEEP 768:N4gTlIWgzpLpyrdv0uF8GNYlbv7kZ4Vjuop2FPZ:N4FdLRg0xYOVjuoGZ
- TLSH
  T1EED2D1DBD048AC30D802D9BEE5D8090EFC10640AD65BFAABA95D319FC101CAA535F95E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  policies/dishonorably.docx
- Size 33KB
- SHA256 6e74f16155640685d0d346e186f2b35423b42c451c7d36bee09318d508f48f34
- MD5 beb2f9ca014827481cdf56a5387d0d54
- SHA1 5271f7bd0a7c832997b088e02bd3817ae46696ce
- SHA512 cadbfb8f6de40414ab404a42a9db689f6e0be3e70f81a9287c34e5be6d5e5a135d8278c02e2aa490ef0212b5872005c664ebce6a71499288b1fee736f7d8081f
- SSDEEP 768:W4PQ0DWMdaT7bKF8ZAVE+xsT9e+lBXa4gKZaRdVr+d/RxP2FPkp:ZY0HUXeFaoj+bKCs/Vr+d/7skp
- TLSH
  T1A9F2F168CC8EAE74D1024BB6D45912A1F8FBCEA7836756D37E0A4904D607DC78F03B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  policies/elasticum.docx
- Size 28KB
- SHA256 cfdc6c1b9b1a086b0c516f044f1c07ccf4e3f5426c12144a301dec734ebd88f7
- MD5 757e4b0faf2f0636477df8fa8386fdb3
- SHA1 5e8c35042b61592bf80d829516cf89820fd1ffd2
- SHA512 4ebdeeec07e0ba3aec7ffb80e48272eea04019e8fa09564aef14c52d7647b25b546266b73a326cb1ca53974bf6d85d00abd7be377614aae0636e94f6e860ca71
- SSDEEP 768:zKFUcGd4ElHIuoWf55ajCshY8YgSModV2iUPMz2FP6:zKFUZi884vEhYjModV2iUP/6
- TLSH
  T13AD2E0D8C0589C20C352C3F5D82799CAE1D0455A72ADE58E3ADE1AA91507B8F328F72F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  policies/godkin.docx
- Size 31KB
- SHA256 a21c109418dc547c68d0b8fd1a25db1746eeadb084c44fc8c4a34b376646506d
- MD5 b5f9ac526f97b67ed7a2e85dac3efeac
- SHA1 a234d5fda192f96c7aac8212ff2944c7c329749c
- SHA512 a6ab45cc0ad9736f864bd2924f18b91afc079ae54b57157918f8838e6949f8a0686a03d1a0367071fed981d83d8192a3f076fb0ffc5baa0030ca9bb5d6907127
- SSDEEP 768:1xd0AWV1y/Psbv5Ua8DGtHuXe4kHnGzcrMJ5r9GdA+L0V7rbz2FPC:fI1ySBUa8DGtH84HGOMJ5r9GO+4V7rbB
- TLSH
  T197E2D01ED059447DEB129975A0BA1573F42588C208CBA16B3E0C2FE994478E723ABF9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  policies/guacamole.docx
- Size 30KB
- SHA256 01d4137031161a2ac26b8301574f1500177e8779b6f6e797d41f606ff6ad43a4
- MD5 5fb6518b7fdc1a5f1d13d004f3db1eb3
- SHA1 88930b5d16fe8aaebba99d5ca1ab32c056ae2d44
- SHA512 0c6d09f8d436de30d35330985e392cf49bcd45b61c360f9a70f721f2ae8a1a9b5de475a4c718d899935dce97bfc898fac5e09704dcea704b295de2fb7f511e23
- SSDEEP 768:rlrSBIC2ZGBjJbrAj++qKl0t/6vDVleUAXsbHNVHiVb2FPN:rl2B32ZcdMOKdDVgUPjNVHiVAN
- TLSH
  T1B3E2E178869D8615C510EB72E36911BAFEC09CD787AAC6477CA053EBC8C5AD6130BE4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  policies/infanthood.docx
- Size 36KB
- SHA256 639fe3abba800e438df0ef1dec74e2d90b8801c11e1612589fd436814fc4f82c
- MD5 10356f54f5d2fc7c77caef5aeab0e57b
- SHA1 87299e52fac54c2dce563d2d10d518f8bc5954e1
- SHA512 59173dfcd8791709a9a12c37a4bfad64125ab8e049bc9c5d7b16ede12a9f4f361605849d4ebb95fa542f3948abdc1cc5f18507adae925f1e931350e97a8c052b
- SSDEEP 768:u2/+iDn7bKq7MZpQ9q25qeHPyA//uVQdpzV1IFU2FPI:ue+iDn7bKmMZC5qevuQdNV1IFZI
- TLSH
  T1EDF2E0C5E4C9E920D051AD3AFB1608A3F480F947C2ECF896BB4E6947D803DC6951A7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  policies/mammillated.docx
- Size 23KB
- SHA256 ab3707c83d5468bd02ccaea8b0f89a119fb4e52f3b5f9ddb6e4e572da91d011b
- MD5 54dbfe476f1ced9b2ee627718280d2e5
- SHA1 85ec7f9e7ff6fc03cd3c6b7dc5a7be8d6c09b59f
- SHA512 deab32669f4854016ea800087b26147d402c321b87cbee518021053a01b49b14f1ca06820dd3569369418bec1984b0a24669f53d06dd962e4cda6166fc8f6034
- SSDEEP 384:m4HN6b3r6SszsPJMOp9943Bk1v2ItumbRLg7OJsbpIh2cX9Vh06Llnnz21RFe3SM:F6X6SygMWtv2huLg7RbSEcNVh06F2FPM
- TLSH
  T133B2C0E4C1EDAA32EA00D7F3912158BBF561D803A06DD53777CD7AE579029F22325A09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  policies/overtalkatively.docx
- Size 30KB
- SHA256 b250598ac9a26b800c83d952d3eddb062125a7d697ae1578d348730d28e43ec3
- MD5 bfe105952ca47afddc9989d5f40bf763
- SHA1 8adbfa8378556f6558ee5cd7a73391d50339ec3f
- SHA512 65c3c3def981d067b20e8f1a38e6cad0ac1a60c04e2ddfa047617777c31eb26b68b1df45a08f15c7880e737bd086e48df47a1b7034ffc257b1909780edc64d27
- SSDEEP 768:pp78SCc33ZwZmYPI7YOdrLN+L1V67roWxiM8VY4CpJ2FPp:ppgg33Zki5drLN+O7kWUM8VY4CUp
- TLSH
  T18CD2D066D18ACC24C792073BC0C802726966B4929FC7E6937E5CA278C453DDEB31D64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  policies/snapshotting.docx
- Size 19KB
- SHA256 bc269eb85ce67bea1ae961d62c5cabda234a56de00f5220edfe8ed128749b727
- MD5 f697d7d2dffe6c68c1f3ed368d3e4508
- SHA1 3a3e1e9d570e1d8e4315b61e31d4b5743d56b211
- SHA512 6bd30cf48224f4e500e52f45e5ea806a54eb1d54bcbc0903ae3cb5a473871cb845048095058837583ce865841170f7b416959e5ebb595cdd7038466bf37db5e8
- SSDEEP 384:48nEnENlYkxZB0F2wTS9v6Xe86de5Zsh6UXin4XV0pqtZnz21RFe3S6cZe:48nEnol//gT6reMA74XV0pqH2FPO
- TLSH
  T11692CFD1948D8835CA124631C66252D7F438D817865FEABB6F1C338D7E07EDA134EB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects SectopRAT aka Arechclient2

Family: NetSupport

Family: SectopRAT

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32