MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02bf7105a46192f398967f9e61ccfb67115a61cc4c675e03e86bcad683191791. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02bf7105a46192f398967f9e61ccfb67115a61cc4c675e03e86bcad683191791
SHA3-384 hash: 072a861579fd72bcdb86ea2825c044308573c8e63ea097f9832af77483d0be0dcb561be562929f65c21ad89b039d4557
SHA1 hash: 42ba4c8ba5244d1df3fa38bedf9c66e17a5c6a2d
MD5 hash: 0c1cc5e0a3f2dc1328636abb97846fb0
humanhash: july-thirteen-mockingbird-march
File name:0c1cc5e0a3f2dc1328636abb97846fb0.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:37'159'269 bytes
First seen:2022-11-16 09:25:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (389 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 49152:6BFwFFKr5i6t9G97Cuzt4NliQ0J4Evu6P0EkHbG+r0/xjMW4uJ5yQ3N6EK8UBp1J:8yFKwsqHt4zifzGk8sgID35K8ULNC
Threatray 229 similar samples on MalwareBazaar
TLSH T129872302B9C79073D4B11C761921B722ABBDBEE51F61CDCFE3C1765E8A702919B31682
TrID 84.3% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
5.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.3% (.EXE) Win64 Executable (generic) (10523/12/4)
2.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon f0e8c4ecd0e871b2 (1 x NetSupport)
Reporter abuse_ch
Tags:exe NetSupport


Avatar
abuse_ch
NetSupport C2:
176.124.217.215:3026

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
netsupport
Create hunting rule
ID:
1
File name:
0c1cc5e0a3f2dc1328636abb97846fb0.exe
Verdict:
Malicious activity
Analysis date:
2022-11-16 09:27:47 UTC
Tags:
unwanted netsupport loader
Link:
https://app.any.run/tasks/4bf96431-84be-42ba-9254-d76413e21107

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Running batch commands
Moving a recently created file
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
DNS request
Creating a service
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Sending a custom TCP request
Transferring files using the Background Intelligent Transfer Service (BITS)
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Moving a file to the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware netsupportmanager overlay remoteadmin setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6374acac4dc24c6f80b830ce/reports/c4408071-eaf2-46b6-b671-9e57b0a9e96b/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1114684
Signature
Found evasive API chain checking for user administrative privileges
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747379 Sample: uSnaL6mEOU.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 64 72 Snort IDS alert for network traffic 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Uses known network protocols on non-standard ports 2->76 8 uSnaL6mEOU.exe 1 20 2->8         started        11 client32.exe 2->11         started        process3 file4 46 C:\ProgramData\HelperNet\remcmdstub.exe, PE32 8->46 dropped 48 C:\ProgramData\HelperNet\pcicapi.dll, PE32 8->48 dropped 50 C:\ProgramData\HelperNet\msvcr100.dll, PE32 8->50 dropped 52 7 other files (none is malicious) 8->52 dropped 13 cmd.exe 1 8->13         started        process5 file6 62 C:\ProgramData\ChromeSetup.exe (copy), PE32 13->62 dropped 16 ChromeSetup.exe 74 13->16         started        20 client32.exe 18 13->20         started        23 xcopy.exe 16 13->23         started        25 3 other processes 13->25 process7 dnsIp8 30 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 16->30 dropped 32 C:\Program Files (x86)behaviorgraphoogle\...\psuser.dll, PE32 16->32 dropped 34 C:\Program Files (x86)\...\psmachine_64.dll, PE32+ 16->34 dropped 42 65 other files (none is malicious) 16->42 dropped 70 Found evasive API chain checking for user administrative privileges 16->70 27 GoogleUpdate.exe 3 72 16->27         started        64 neashell1.com 176.124.217.215, 3026, 49714 GULFSTREAMUA Russian Federation 20->64 66 geography.netsupportsoftware.com 62.172.138.67, 49715, 80 BTGB United Kingdom 20->66 68 geo.netsupportsoftware.com 20->68 36 C:\Users\user\AppData\...\remcmdstub.exe, PE32 23->36 dropped 38 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 23->38 dropped 40 C:\Users\user\AppData\...\msvcr100.dll, PE32 23->40 dropped 44 6 other files (none is malicious) 23->44 dropped file9 signatures10 process11 file12 54 C:\Program Files (x86)\...behaviorgraphoogleUpdate.exe, PE32 27->54 dropped 56 C:\Program Files (x86)\...\psuser_64.dll, PE32+ 27->56 dropped 58 C:\Program Files (x86)behaviorgraphoogle\...\psuser.dll, PE32 27->58 dropped 60 66 other files (none is malicious) 27->60 dropped
Gathering data
Threat name:
Win32.Infostealer.ChePro
Create hunting rule
Status:
Malicious
First seen:
2022-11-11 21:25:00 UTC
File Type:
PE (Exe)
Extracted files:
485
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ak7xcbnemgjphgewp6pgdth3m4ivuyomjrtv4a7inpfnnayzc6iq._file
Verdict:
malicious
Similar samples:
23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb
NetSupport
3fd0837381babda7ef617b810457f0db32bd7c1f7e345480e6c525050ca818fa
NetSupport
638fa26aea7fe6ebefe398818b09277d01c4521a966ff39b77035b04c058df60
NetSupport
8f3bb770ad8cafcabe4eba9f67ba79f353ddee4caf30532e724bdeb15489df64
NetSupport
bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
NetSupport
e097cde0f76df948f039584045acfa6bd7ef863141560815d12c3c6e6452dce4
NetSupport
f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
NetSupport
+ 219 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery evasion persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/221116-ld7kqsdh6y/
Behaviour
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Modifies Installed Components in the registry
Registers COM server for autorun
Sets file execution options in registry
Sets file to hidden
NetSupport
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/22e16b5c-7247-4794-9e75-6b0c2082b103
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02bf7105a46192f398967f9e61ccfb67115a61cc4c675e03e86bcad683191791

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments