Overview

overview

10

Static

static

3

usa.confirm.exe

windows10-2004-x64

10

usa.confirm.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    usa.confirm.exe
  • Size 12.8MB
  • Sample260228-sdl3csbw8a
  • SHA256 c9e5bb7a368280d771edcfdb33717a3130560d2bb71773ab1aaffe0eb585fd2c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
netsupportdefense_evasiondiscoveryexecutionpyinstallerrat

Malware Config

Targets

    • Target
      usa.confirm.exe
    • Size 12.8MB
    • SHA256 c9e5bb7a368280d771edcfdb33717a3130560d2bb71773ab1aaffe0eb585fd2c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionnetsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VirtualBox drivers on disk

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Looks for VMWare drivers on disk

      defense_evasion

    • Looks for VMWare services registry key.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks