MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347
SHA3-384 hash: 7a0f97df22268f2c57966e2809689b61e526a40021512a8961f083e300ad0b5fafc7387c057d496eb24bdb8c4f5193af
SHA1 hash: 7de12e91dda37e569dfc9e52e0087aafd3a6456d
MD5 hash: 62bc1d0e287775a59307179aa05310b0
humanhash: cola-bravo-lima-angel
File name:Client32_sdjfnvnbbz-pw.ini
Download: download sample
File size:700 bytes
First seen:2023-10-11 13:58:27 UTC
Last seen:2023-11-22 14:06:27 UTC
File type:
MIME type:text/plain
ssdeep 12:+AxS2hz7YU+Sj8ZGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuQzQ9DA+zQdhzf:XI2hzEPI8ZNR8pivlnxOoG1fXXfD/zsw
TLSH T1690176016E8EBDBE1147F2D3B67401E82BC34410F4887A317B845C0F5D72CA940EE8A4
Reporter JAMESWT_WT
Tags:config ini NetSupport sdjfnvnbbz-pw

Intelligence

File Origin
# of uploads :
5
# of downloads :
110
Origin country :
IT IT
Vendor Threat Intelligence
Gathering data
Verdict:
Malicious
Labled as:
NetSupportManager.AD trojan
Link:
https://www.hybrid-analysis.com/sample/28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347
Result
Verdict:
MALICIOUS
Score:
2%
Verdict:
Benign
File Type:
ASCII
Link:
https://malprob.io/report/28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=faqixksqpmtaylpwmn2cpxucvucchqqofphm5ojluxlwa5g42ndq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28208baa507b260c2df6637427de82ad0423c20e2bceceb92ba5d76074dcd347

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NetSupportRAT_Config
Create hunting rule
Author:abuse.ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments