MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90
SHA3-384 hash:	999868e91ee607c1d8f17ed6d1e06945f850d3a8867e06157bf0a42d300e109d30417107d8bb8f45d71300d6d0565116
SHA1 hash:	a6b7839d287c71e8c724df8cc024c4f7d7ae9057
MD5 hash:	999440b3b0609a7fa2f06f4d07fa8e6e
humanhash:	mars-oranges-butter-july
File name:	a6b7839d287c71e8c724df8cc024c4f7d7ae9057
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	4'767'744 bytes
First seen:	2024-11-08 17:58:33 UTC
Last seen:	2024-11-22 12:36:58 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	98304:DAowTTYcM2Pewg9Y6mnjZpLhL8QaQs74iQlSKsrM18o4bbmo+IW/+b:DAouq2PW9YJjjLhPq4VlSKuMkb7r++b
TLSH	T1D22633683858272CE5325B34A51AD6789E60BF6BE7FAD1371882F58D87713A1B1F3C10
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	NDA0E
Tags:	armayalitim-com armayalitim1722-com msi NetSupport signed Xiamen Huixiantong Network Technology Co Ltd

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

89

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Program.RemoteAdmin.936.32171.8800.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=672e519fa5bee3c9d42be652

Tags:

dropper netsup trojan virus

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

installer packed

Link:

https://www.filescan.io/uploads/672e516653112d61aaa98690/reports/338ec515-6a8e-4eb4-9302-0ff4aa77a8cf/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90

Joe Sandbox NetSupport RAT

Result

Threat name:

NetSupport RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1552423

Signature

AI detected suspicious sample

Contains functionalty to change the wallpaper

Delayed program exit found

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fihusxgslxf7akzlbmiqgljsubdazg34llkjdl5eayhkhsthl6ia._file

Threatray netsupportmanagerrat

Verdict:

malicious

Label(s):

netsupportmanagerrat

Alert

Create hunting rule

Similar samples:

error

NetSupport

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport discovery persistence privilege_escalation rat

Link:

https://tria.ge/reports/241108-wkpzdaxann/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

NetSupport

Netsupport family

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/30ccddc2-cfc6-4ad0-824a-20aa7a76f6c8

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2a0f495cd25dcbf02b2b0b11032d32a0460c9b7c5ad491afa4060ea3ca675f90