netsupport

Sharing

Copy URL Twitter E-mail

General

Target
sublime_textx64.exe
Size 20.5MB
Sample250708-m77chawvbw
SHA256 bd97ecf1a07fbc5cc1cfcbdfb73368e01f14c3e8abe061f73543627bddd9eb6d
MD5 46720657043a17fe55e1c1637718308b
SHA1 bd1ddd7bbde4338d71b7db508d232fc890f31ca1
SHA512 d16871cdc9562b7199c737a8e2bcba3b23c441108ed8509c959da2d5435c92ebde0e83a2b896887d60095dd28dbaa5161a710bc234b7e315f9b3bbdcc57ce35e
SSDEEP 393216:2Zag92Nb3lLJAqF5NjyTOo3dIOTqm5XR8qNv+a9YrJDyjXb+:26xJAqPNeTOo3TnR3B9QJDO+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  sublime_textx64.exe
- Size 20.5MB
- SHA256 bd97ecf1a07fbc5cc1cfcbdfb73368e01f14c3e8abe061f73543627bddd9eb6d
- MD5 46720657043a17fe55e1c1637718308b
- SHA1 bd1ddd7bbde4338d71b7db508d232fc890f31ca1
- SHA512 d16871cdc9562b7199c737a8e2bcba3b23c441108ed8509c959da2d5435c92ebde0e83a2b896887d60095dd28dbaa5161a710bc234b7e315f9b3bbdcc57ce35e
- SSDEEP 393216:2Zag92Nb3lLJAqF5NjyTOo3dIOTqm5XR8qNv+a9YrJDyjXb+:26xJAqPNeTOo3TnR3B9QJDO+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netsupport discovery persistence rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  __future__.pyo
- Size 4KB
- SHA256 0f836a62d2599cdbd804e4ba76510b29a052d1a7445bf0471f498b628b783fc7
- MD5 2f5218c4c4aa63fd8ad862e15ed8d477
- SHA1 914c54313d5eaee1662d4861f7dc4c7567f0e873
- SHA512 2e383f68c0b46f3c01ff10c6465b17eab9f191c74f2cc4737fc7a63eec4e0abe92ba712d567f531ff18a294aa336085754a6e39448711fdefbd05e256cd22406
- SSDEEP 96:B29NzUuGd+P2sKNlW1/DWuncAk6plr8Cl9o:Bu4BRlWBDcAn849o
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  __phello__.foo.pyo
- Size 124B
- SHA256 a458bf7b598f8b2079abbb4e2f8cc4c0846d9c22c657e676285fc88c17c3ec96
- MD5 8bb75ffe71bb6716aa20e4881891eaed
- SHA1 b338ec10004b08cbf372cf66a380b1fb29438f2c
- SHA512 3c85bb03d6e4e94e198036126a60c85ed1efad796c52882c02e4f76ea45b38b5d9239cb295509386966f35836e0ec28d4093c7f9c6329198d6046ba9b3adaa86
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  _compat_pickle.pyo
- Size 5KB
- SHA256 7d8fa76fcfb258b52f7add9b8deed6499230a37752b3f44aa66ea44d5b65c51f
- MD5 5c87dba82140704b1d1d339c649de1aa
- SHA1 35469afd18e55e6cf33a28dd2e1d198f82599969
- SHA512 ee66fc35de1b1da3c1ffe3be2282f1e2bc9d5dcbd0137e66c135f61c9fc725da81dafaf4679896ff196c52c7aa8052525958a35face7b35fb02c49138c139432
- SSDEEP 96:Bt5XRxGRso91v/vLXcT/GHIX6bNFE5g3eMGLu4x4v1tjgBNRIX6bNFE5g3eMGLHM:Bt5XRxGDFDHIX6E5ueMGLu4x4vXURIXE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  _dummy_thread.pyo
- Size 5KB
- SHA256 4c1c8522e57cb8ebb27d9876068a6b042492553501c8a76fcdc7f689b62b66f0
- MD5 905983492d1a937cb73eb6c99f384340
- SHA1 68b46d8a679d464ea6e08f179c3c2bba49ad9ffe
- SHA512 627f37be82b7cbbf91d23130b139030ea5edf49b324a417c127efcbdb3d4e832ecef67773d47bba841952055e390456350930f45b4b697bc3d9b616efe26b79b
- SSDEEP 96:SB+F4vYk/jOkQm0mPvpXB0Pvj+bePvPGzEPvjPvjIoPvKA1oYPvbLZPvE+iPvX2U:Sso/jum0Yhj/h0PVle
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  _markupbase.pyo
- Size 10KB
- SHA256 b837b7030d47488c852f8241b1b0530b1427dca42be37ef460dc14bfd0797261
- MD5 af46d44806cbad43d87486ab03e80643
- SHA1 b1d61493ffab054b6c1378938bc1b5de3cad592a
- SHA512 578337bccd51d921105daa3f7b92e7fbe15edd8b0e4c42067b48a3fae5e2fa8eb2148673058bd3246e189bba7c129ad53bf756e2e9481bf2762aba7bcf2c693c
- SSDEEP 192:a3vX6cV9h9umeklztCRgG5PPBAkQAeWul1Wx6ooXAdyWr5ppbxFS2x2fKC+eY:afXPEkAPPBzQ2y/oLdySl40
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  _osx_support.pyo
- Size 13KB
- SHA256 2b456c4d0d0c6739ca77a3c297b3942a5be7bb8aa9cb38cb63f1769d77a61617
- MD5 fb08bdf9e13f4c053a7ef871c812de91
- SHA1 15314d70bc31d7a28d8ef48c45f7eb9a0b410192
- SHA512 20e2c40075ae8dbcfee745694d55447583237281d9f789d9a32f227fac236fa951d0751df0811a236ea9e8c1c90bc25a3be7150ddbab7d3d1e099b7f655f111d
- SSDEEP 192:wKyJeKYcK1hff4pvKKZ1Ie954sQYokW5fUsaZ7LVaqfuvSQ2ZP/D2o3qtKY5/2a:YnV6fWIe9ukokMfULZVxuv8Pqq1La
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  _pyio.pyo
- Size 79KB
- SHA256 bbe0996b64d3ff251c6b4e296b0f0c93befe229297940f29814e27aa69d7dd00
- MD5 8241e425d139fbbb202722e937ec6a1e
- SHA1 75ada14efedc16548163181d2c57a285e149305e
- SHA512 9cccb9ba927512606482afc7a4d604e758d17007960f10ef46c9c8be566d2ca2a4cba35b46812f64d483bec7f41ee0e514bce5e038cc4bddb9ad8baaa031a31e
- SSDEEP 1536:POJL45TvNVcZMubmcGemTILj4h3vYBSN5mH5ABpdHiQ9QWZcrYpnTcHxjJUGk3c5:WJLWCie1nO3vYBSzmH5ypdHLSo8YhYZV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  _strptime.pyo
- Size 18KB
- SHA256 afb55fdfa0fb0cd696a7617fd52202cf840ee7606c19dc3afb1f34ce0c8bfc11
- MD5 9a59fef39804d0cf1d62de7e29b5599f
- SHA1 798c000aa3e0c512c19a205eb54c58b40ef59e26
- SHA512 6d2641f98e483aa150aa71d9855e95af46aefb1f024bd314fc6cd0aa02d663c2724c969ff946889729f21c601cfa65757c12b02ae664b82f7099d87da9acea64
- SSDEEP 384:ZL8NB6CwihG0RGu47zJNcbaI4wTchehzZmtJ1TecU3kBTU33riMuBN:qlZQ0gl7NNyL4wTc8hzZmtJzTU3OMSN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  _sysconfigdata.pyo
- Size 23KB
- SHA256 5d41186f36b82a700989e7b655e3f5e67c79d87e9236c6165c59720ef17d78c4
- MD5 226fbec34da9d9b29017e01e72a2e80a
- SHA1 242c793e741d79ad77df2034d83cabe2285c156b
- SHA512 4ae8bdcf643b20887ceb3060426229a6901aa3971fe761ed68f63bedb624209fe44d84d24dc4c0aa080206600fac1e5953bd77c807a89245cf24e0a3aef32d74
- SSDEEP 384:vbibkxRrhHtKKpjlLMO4wUxziBzOfVASUVhrBI+g8uYA32gJ1RjYhYbCD:mgxRrNXr0l8lpBI+g1YA3FJshYbe
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  _threading_local.pyo
- Size 8KB
- SHA256 e4a5220cdd5fe9a13208d762ab24166c2938921054cede36b7047fe889aba40f
- MD5 428a05d0b58582e675b3bb3463d0648c
- SHA1 27243d6090da910521d1c0e628139c40c3005b2a
- SHA512 934ca5e44b08142cddb1f5c88c961346af97f619d499a851af01cd556e75f035053332cc6126db97b38674697998548c56def36e6fda360e5c8fa276868aa7ee
- SSDEEP 192:VU+i4mNotgJse/NvUd9rY5TwCkxBVx8k8O7O:Vzi4mNo6se6Y5TwCkxDx8k8OS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  _weakrefset.pyo
- Size 11KB
- SHA256 c4e8ae7b2404c7a816c15d1f1d61407d8cf180bc649c301b8481fb55e35896a7
- MD5 c0ace9e084fedc13b05aacad8b904fe4
- SHA1 c8c5044cc6c77cfaea041e6a24322cae4482094a
- SHA512 93c6913fe35ebe8920533477868a3ac165043d3d0b24fb51b8c82ef707f34c7aaaccfcf571f9072d9dc9b070420a516bf330f5d8f5b21897db332ce43e2ce9e4
- SSDEEP 192:CkJbWQq7KUeArk3oDpwEsTw65bCoTcROEnqi8aBMnOwxs3yZMDD5Jh1C5bFeyxSw:t8kUea10fZ0ROEqi8bOwxs2MDLh1CHem
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  abc.pyo
- Size 9KB
- SHA256 32cd538f28a5826f124378822516d05c460a027cfcfeb7dc22960bdcd547e6ef
- MD5 2171e0f6f3465bef8cef0ba5f2653e9b
- SHA1 c609080dc6f768cfea1ba9ed31a829ca33bf5a37
- SHA512 f779813ba51b53bd416cf58d445b17410e1911e9ade0b7342a6df6a0a66ab41adaa4285d74e083d2ee5a3466b0774288fb49755ca02b432189a80eee97d2309b
- SSDEEP 192:y2+J2VRz12NRWltCEqd8152K6Z75FPrVRG01x3vpa2w3jdr:y2+OvltCEI9VRG01x3vpaPj5
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  aifc.pyo
- Size 33KB
- SHA256 c48577ac5d7cf712e46bc89eee98087bc886afa4b1343d837a055c109647c76d
- MD5 47e41ab4da9d68e7e8f62217a1a49428
- SHA1 c8ba55343b21dfe9fc206e9dd7e42a91353c3a30
- SHA512 cfac78340e26c3647ffe243b4e002198794fbf364aeb9c949e8094c04422743f78abcff00f06108eae455496403b322441fdc26ed6a01d58f7cc880018632642
- SSDEEP 768:uPk5F3FHWMHDzYmy3pp/zfgRgYzqYyRuOrXjZRs+R+:Z5F3F2Mg5p/zf4gYj9QhR+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  antigravity.pyo
- Size 1003B
- SHA256 643147fd0e238d8376802d3dac1f32abf6773e1a64e97b5476958d25225ee80d
- MD5 ee7ae4788d52a54a10256df6fd2cff49
- SHA1 21349f1615a253f905908bace33493505ceafbc1
- SHA512 3d7c54fb803d6e48f42aca9903bd5ba43bd5ce64e52c6923c487603dbc1e307a031a8a00444a73cab3dbb9bdcfb11027faa141dba4c26292b1fc3f15974976ea
- MD5 SHA1 SHA512
Score

3^/10
behavioral29 behavioral30
- Target
  argparse.pyo
- Size 87KB
- SHA256 d9f9405cee7b3b854f3a74ce0373d0d50c49b2ad1d6fc8ceac2ba375b22a6664
- MD5 a42d5938576f14744a3b6aa1db344915
- SHA1 22362f95f09f2d25e467e4ce4d112bd0e7f9159f
- SHA512 c189ccea806b0d81077f4442169f7584d515330cd0370681f87fe999c3cc7655adc6daa26ba8cae69e7b83a1432c4f2825222f0724812b17b3f6c50476df5ffd
- SSDEEP 1536:MpzLerNRTy2Yr5DZQHTxYVCkDb/igHQEDfOXvE7gc/N2WqkP3G9RSv2N1AmQWosD:MQPTy26rbES2XMTywv2dAjrpFNHDk0i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Netsupport family

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32