MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 9


Intelligence 9 IOCs 4 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c
SHA3-384 hash: 9315d38041184bb99fc8836ca3739dba8462daa0df0685c4933dc679a0af9c21ca941442e0708e0ab8de5c2f2b6e389c
SHA1 hash: 33a81d32c114e65434f2213ef78d78674d23c1dd
MD5 hash: 41ccf2991faf22d76a6d0f1bc576676c
humanhash: monkey-quebec-social-jersey
File name:41CCF2991FAF22D76A6D0F1BC576676C.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:543'333 bytes
First seen:2021-06-10 23:06:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'503 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 12288:DQi3j/LWJ6m6URA3PhDbkVEEN6+Jj+RUP7Wrd9CjbJQAl:DQirSMhhDyFg47/
Threatray 45 similar samples on MalwareBazaar
TLSH 92C40109E6AB8436D10289B03D36BEF471237D16187B1C1772B96A6F5B3207FD938762
Reporter abuse_ch
Tags:exe NetSupport


Avatar
abuse_ch
NetSupport C2:
104.21.2.30:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
104.21.2.30:80 https://threatfox.abuse.ch/ioc/87999/
45.14.14.238:39944 https://threatfox.abuse.ch/ioc/88000/
141.136.0.128:80 https://threatfox.abuse.ch/ioc/88005/
193.110.3.160:80 https://threatfox.abuse.ch/ioc/88461/

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
41CCF2991FAF22D76A6D0F1BC576676C.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-10 23:07:47 UTC
Tags:
installer
Link:
https://app.any.run/tasks/35d620a3-6a92-4aed-a139-12c494c4d61a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165974/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Application.Agent.AIQ.2330.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
DNS request
Connecting to a non-recommended domain
Sending an HTTP GET request
Sending a UDP request
Creating a process with a hidden window
Sending a custom TCP request
Creating a file in the Program Files subdirectories
Sending an HTTP POST request
Creating a file
Moving a file to the Program Files subdirectory
Deleting a recently created file
Adding an access-denied ACE
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the Windows subdirectories
Launching cmd.exe command interpreter
Running batch commands
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Unauthorized injection to a recently created process
Setting a single autorun event
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800560
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 432956 Sample: crt9O3URua.exe Startdate: 11/06/2021 Architecture: WINDOWS Score: 100 115 www.cloud-security.xyz 2->115 117 www.directdexchange.com 2->117 119 27 other IPs or domains 2->119 167 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->167 169 Multi AV Scanner detection for domain / URL 2->169 171 Antivirus detection for URL or domain 2->171 175 7 other signatures 2->175 11 crt9O3URua.exe 2 2->11         started        14 Talaedicasha.exe 2->14         started        signatures3 173 Performs DNS queries to domains with low reputation 117->173 process4 dnsIp5 93 C:\Users\user\AppData\...\crt9O3URua.tmp, PE32 11->93 dropped 17 crt9O3URua.tmp 3 19 11->17         started        157 cor-tips.com 14->157 95 C:\Program Files (x86)\...\Windows Update.exe, PE32 14->95 dropped 97 C:\...\Windows Update.exe.config, XML 14->97 dropped 21 Windows Update.exe 14->21         started        file6 process7 dnsIp8 107 cor-tips.com 198.54.116.159, 49733, 49743, 49795 NAMECHEAP-NETUS United States 17->107 73 C:\Users\...\___________Food_C235_2427.exe, PE32 17->73 dropped 75 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 17->75 dropped 77 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 17->77 dropped 79 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 17->79 dropped 23 ___________Food_C235_2427.exe 22 20 17->23         started        109 vexacion.com 21->109 111 reportyuwt4sbackv97qarke3.com 21->111 113 connectini.net 21->113 81 C:\Program Files (x86)\...\Talaedicasha.exe, PE32 21->81 dropped 83 C:\Users\user\AppData\...\OQJSUCQKJN.exe, PE32 21->83 dropped 28 Dujovuxuma.exe 21->28         started        file9 process10 dnsIp11 151 iplogger.org 88.99.66.31, 443, 49752, 49962 HETZNER-ASDE Germany 23->151 153 connectini.net 162.0.210.44, 443, 49738, 49751 ACPCA Canada 23->153 155 2 other IPs or domains 23->155 85 C:\...\Talaedicasha.exe.config, XML 23->85 dropped 87 C:\Users\user\AppData\...\Dujovuxuma.exe, PE32 23->87 dropped 89 C:\Users\user\AppData\...\Fibihabaeca.exe, PE32 23->89 dropped 91 C:\Program Filesbehaviorgraphoogle\...\prolab.exe, PE32 23->91 dropped 177 Detected unpacking (overwrites its own PE header) 23->177 30 Dujovuxuma.exe 14 5 23->30         started        33 Fibihabaeca.exe 23->33         started        36 prolab.exe 2 23->36         started        file12 signatures13 process14 dnsIp15 159 connectini.net 30->159 38 iexplore.exe 30->38         started        41 iexplore.exe 30->41         started        43 iexplore.exe 30->43         started        48 38 other processes 30->48 161 jukaiop.pw 111.90.146.149 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY Malaysia 33->161 163 ferstappen.com 45.91.67.130, 49979, 80 NILSATBG Russian Federation 33->163 165 7 other IPs or domains 33->165 67 C:\Users\user\AppData\Local\...\ebook.exe, PE32 33->67 dropped 69 C:\Users\user\AppData\Local\Temp\...\0001.exe, PE32 33->69 dropped 71 C:\Users\user\AppData\Local\...\prolab.tmp, PE32 36->71 dropped 45 prolab.tmp 27 26 36->45         started        file16 process17 dnsIp18 147 4 other IPs or domains 38->147 50 iexplore.exe 38->50         started        53 iexplore.exe 38->53         started        137 www.cloud-security.xyz 41->137 139 cloud-security.xyz 41->139 55 iexplore.exe 41->55         started        141 www.cloud-security.xyz 43->141 143 cloud-security.xyz 43->143 57 iexplore.exe 43->57         started        99 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 45->99 dropped 101 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 45->101 dropped 103 C:\Program Files (x86)\...\is-KNM23.tmp, PE32 45->103 dropped 105 8 other files (none is malicious) 45->105 dropped 145 www.cloud-security.xyz 48->145 149 25 other IPs or domains 48->149 59 iexplore.exe 48->59         started        61 iexplore.exe 48->61         started        63 iexplore.exe 48->63         started        65 12 other processes 48->65 file19 process20 dnsIp21 125 34 other IPs or domains 50->125 127 14 other IPs or domains 53->127 129 11 other IPs or domains 55->129 131 4 other IPs or domains 57->131 133 12 other IPs or domains 59->133 121 www.profitabletrustednetwork.com 192.243.59.20, 443, 49753, 49754 ADVANCEDHOSTERS-ASNL Dominica 61->121 123 vexacion.com 139.45.197.236, 443, 49755, 49756 RETN-ASEU Netherlands 63->123 135 5 other IPs or domains 65->135
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-06-09 06:36:31 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebmt3vakybkz5zehkydylfw4jawvyhxec5iytcdxpy2mc5gadu6a._file
Verdict:
unknown
Similar samples:
11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4
NetSupport
2e29c4a8aa64659e07fb2e157f5a3f2cc6e322ed5b9299b15aa40886acf5c6f9
NetSupport
3c2fa1d04daaea31991c29bb4118c3d146a50815a033ea5ae325c3171ebdf713
NetSupport
738108e1651deb6c04e05a4a2680819283433189eff93426a56e834381b5e4b5
NetSupport
864ef1321215c0dad7c8677e3c18942b111468c63358475baa71fb1679c25096
NetSupport
8e4f30afa8d0ce48c46a39e2754d8f7adad90ae8ccaf0132b354be76076b20cc
NetSupport
a28956c03af41c83a80a84889bd4b2528c3842f14ca44d7c2d3362cbaa036b8d
NetSupport
aa9be79c40da851c806a4cbd196aad2731e57090c5c4e0bb107437073e0ebd11
NetSupport
e13ba9f6e63e4013b75c3d45b012d8cbdda80913669bdd10942828b05d66e798
NetSupport
f92ea3668a35fbf6e26ba93ed3c2ee31235e41013b79cd661aa061d1327540d9
NetSupport
+ 35 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:plugx family:vidar discovery evasion persistence spyware stealer trojan upx vmprotect
Link:
https://tria.ge/reports/210610-n8636pf7vn/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
UPX packed file
VMProtect packed file
Checks for common network interception software
Vidar Stealer
Modifies Windows Defender Real-time Protection settings
PlugX
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Unpacked files
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/009f525c-6827-4df9-8852-c165e8a32d9d/
SH256 hash:
5700803740a7d15e2c6fbf40524a73266a6e875aa9614040bb818a86ae22f37c
MD5 hash:
5a5f86d20a6292dd3ab0d5a70a4279d9
SHA1 hash:
122cfa0116af80aac6f361f14a8d316cc9e10c9d
Link:
https://www.unpac.me/results/009f525c-6827-4df9-8852-c165e8a32d9d/
SH256 hash:
20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c
MD5 hash:
41ccf2991faf22d76a6d0f1bc576676c
SHA1 hash:
33a81d32c114e65434f2213ef78d78674d23c1dd
Link:
https://www.unpac.me/results/009f525c-6827-4df9-8852-c165e8a32d9d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20593dd40ac0559ee48756078596dc482d5c1ee417518988777e34c174c01d3c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165974/

Comments