MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetSupport
Vendor detections: 10
| SHA256 hash: | 36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c |
|---|---|
| SHA3-384 hash: | 5094d599bc7138e4cd2b692c47144fe03c09077d88660d80685c8e4da2e1e7c443b172ec2e24b2c86d5acc1fdbf6a121 |
| SHA1 hash: | 134c131779666424cc98fd15e384d174cfcf16e6 |
| MD5 hash: | 930dafe31a08adcef3cc066d16d40982 |
| humanhash: | oxygen-oxygen-chicken-queen |
| File name: | 930dafe31a08adcef3cc066d16d40982.exe |
| Download: | download sample |
| Signature | NetSupport |
| File size: | 2'573'832 bytes |
| First seen: | 2023-03-08 02:55:34 UTC |
| Last seen: | 2023-03-08 04:26:54 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1f4f257947c1b713ca7f9bc25f914039 (4 x NetSupport, 1 x AsyncRAT) |
| ssdeep | 49152:suJdxkp92TMp2OJSyli/TlV56nNeDyQ41Huw9If8DQtqKPi/IBF:Bd6Ugp2Jx6UyQ41uw9IkDUiu |
| Threatray | 71 similar samples on MalwareBazaar |
| TLSH | T17DC5E022BA52C1F8C5B112F0C850C3FA9DA6ED6ED714543B430D3F66B7B42866ED1AD2 |
| TrID | 73.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 8.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 4.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.6% (.SCR) Windows screen saver (13097/50/3) 2.9% (.EXE) Win64 Executable (generic) (10523/12/4) |
| File icon (PE): |  |
| dhash icon | 8e160e8e978f9696 (1 x NetSupport) |
| Reporter |  abuse_ch |
| Tags: | exe NetSupport |
Intelligence
File Origin
# of uploads :
2
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
netsupport
ID:
1
File name:
930dafe31a08adcef3cc066d16d40982.exe
Verdict:
Malicious activity
Analysis date:
2023-03-08 02:59:00 UTC
Tags:
unwanted netsupport
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Sending an HTTP GET request
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware overlay packed remoteadmin shell32.dll virus
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.troj
Score:
64 / 100
Signature
Found potential ransomware demand text
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 61 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Score:
10/10
Tags:
family:netsupport rat
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
NetSupport
Unpacked files
SH256 hash:
d2e2f99acaa755c3247068ea9f7bec11d787fcb33047d9fc17590a6137f96ff3
MD5 hash:
a9c0c94b121dd567a162f4d9ea829f1a
SHA1 hash:
e2e62a1aaa91edc1abe0b66aff69d735148daa15
SH256 hash:
8da5cc4247bdc39826e06e5501dd16ff14100708fd7398a9cf565f7931d91487
MD5 hash:
93e0c38cea9e6a6cb4a514ed5fcebfe0
SHA1 hash:
8665f95b9e1f9c8960e388c9277a428d841da80b
SH256 hash:
bc04c0a5a0912747016a54d842946e248da5d7d8c48cde26e6037344e180be7d
MD5 hash:
66dc4e242b8f9c0f301008a8c189a1bc
SHA1 hash:
80759db64448a161bab2237c9355fc27ac2f6140
SH256 hash:
6e720ea9eaf790bd3bfd0b9538116f859d075cb21372730b3b61c523cb223ab5
MD5 hash:
c1e217cbfdebbe6efda449483ed26184
SHA1 hash:
266fa8bfc609caa23cf9d58b83503bcacd605591
SH256 hash:
f618011fb6eac7e939db2f3da6b0a63da6363ad1f302450a5dfcc318694ce89e
MD5 hash:
8834da530a6916899d892bb72bde5714
SHA1 hash:
130b00d7956918261c9dac11d28db105299ff705
SH256 hash:
6c1ee07f1873a7aaa71e484cb6935684972ecead230089e9b93af8821daa12e9
MD5 hash:
912e86bf7d3d18edba8cf1a8c1ef4714
SHA1 hash:
c5164c893261613cd21e57ba877dab9920eb310b
SH256 hash:
36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c
MD5 hash:
930dafe31a08adcef3cc066d16d40982
SHA1 hash:
134c131779666424cc98fd15e384d174cfcf16e6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.