MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41e82e314fceb906d8618dbaa5d622cdea1b453ed74e3d358b5aafee0030490a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41e82e314fceb906d8618dbaa5d622cdea1b453ed74e3d358b5aafee0030490a
SHA3-384 hash: 35f2308a955bb37321295a881bd3ebffd3cee4c398e7afc0e28d0ec262db80e8aca31ff0dac4e6848d6f32ad22db3890
SHA1 hash: 60c64006ee78c63eea23037213c1edaacfa59e88
MD5 hash: 34404cbd63be9620885368460b387695
humanhash: mexico-batman-bulldog-twenty
File name:34404CBD63BE9620885368460B387695.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:3'132'419 bytes
First seen:2021-07-13 19:31:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6aa9b2c4fb8d9d4659266d12b1aa5fc3 (2 x NetSupport)
ssdeep 49152:KDESR4ctGua0qM8xTsP7VQNfnVLmLELJ6AXXe2dAayKlKvq/gZcE9hSzISQq+tte:tSj4umMaQjUCLAXjdrgphScSH+t7dq
Threatray 37 similar samples on MalwareBazaar
TLSH T1F4E53384CB50A91AC0C6B3BB2D39162346B16DF7A4E9D60A210DA65B07347DDFFC827D
Reporter abuse_ch
Tags:exe NetSupport


Avatar
abuse_ch
NetSupport C2:
45.133.203.205:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.133.203.205:443 https://threatfox.abuse.ch/ioc/160144/

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171508/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Dealply-6888374-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Zeppelin Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/68f4d945-8867-451e-8c80-149be85faf4d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/815874
Signature
Drops PE files with a suspicious file extension
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41e82e314fceb906d8618dbaa5d622cdea1b453ed74e3d358b5aafee0030490a/
Threat name:
Win32.Infostealer.ChePro
Create hunting rule
Status:
Malicious
First seen:
2021-07-10 08:56:13 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihuc4mkpz24qnwdbrw5klvrczxvbwrj625hd2nmllkx64abqjefa._file
Verdict:
malicious
Similar samples:
01910bddacbf2ea878b487dd3dfc2cfbeabf1a3dba94309b4a84c9e6b4b4afc9
NetSupport
07eaa6e88904f46157a5e5e45dd70d6e14d5d06aae7dc17e8a2c440ff403a51e
NetSupport
46159df1dd676199e544ddeec7acbb73ded7e90796330390b7db4eb4dd274cbd
NetSupport
6109fdc0254cdefc1462dc6a453ecce1cd70d8b533822d3a11be42604eb47a18
NetSupport
68313d4b45cc908f541dd581d7b9d1e8ccadcbf205714c12c36b58083ada7345
NetSupport
86fc3e58537ac903356866de03df56baaba69b2641f90da283560a08fc60786b
NetSupport
978b4ac05a227b23ef7e4fadff92966339ba1413bac5a45e93f83a3064f8fd2f
NetSupport
9dc68d85aa368791204ac6afba32756a20627cb557478ccaa56abb24f971ece3
NetSupport
b7e88d00739d77f482b500b254c222ae19171e68a5cd574eaee7b43f0cf79f1d
NetSupport
fe271b4266e4d1da6cd411a99f35ef14bba6e93354d43f4b790008d9222e0ba7
NetSupport
+ 27 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport rat upx
Link:
https://tria.ge/reports/210713-gmcr73gh1s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops startup file
Loads dropped DLL
Executes dropped EXE
NetSupport
Unpacked files
SH256 hash:
c76b3cbc4e5e44781ed31a0a5bead1df09050e09fa0fc4125e733ab0f9188305
MD5 hash:
ae9670f1627ed34587d96f6e714fe7e4
SHA1 hash:
0718354de40b0c5207476c0177a778d655cbb31f
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
1b07ef568f410eedfdca59e152f336337afd30f4068d6acc335df2808efdd202
MD5 hash:
f525bd5dcec08be37a94d743d345be14
SHA1 hash:
ed1485111b370e0f75c004c5b253d3bf7ce18cf7
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
9822873977bb05b8fc7f28a4ac802e39e5eff8054d45b3ef85c56263ec265b2b
MD5 hash:
8b9199dca55bbcbca3cd46bde087a97c
SHA1 hash:
b0674c891ab61e7da27a1bd00500158070547422
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
e290cde1bac1a77aca16731e9c2563b582a9b0b0c8d9bc9efb658424326aa096
MD5 hash:
46ce5da5e09d45b0b0c5b118b4807263
SHA1 hash:
8af09d01cc34adb47cb4c2ff2a75b1737b47b67d
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
17aca46156700d70eb6cfce82f99332a14a2f31c1d2d64310750aaf3b502652a
MD5 hash:
eeda3f3f638bf7076805f9cc9f0f384a
SHA1 hash:
572bf26551ecc0c9a0d91bda9cebfb3338585958
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
3ebdffd4a62b10176d3aa60e63de0f8774883beee29f36eddf1e682d36665aba
MD5 hash:
def76ae0b8a0aef42269a1a80634346e
SHA1 hash:
52fb76a4f794d00d29a08e4692692ffa6556ea0f
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
4be10875bd6c725a8df76468ff6783695cddbf00e3596c2f55336a645d21ee9b
MD5 hash:
4252b8bf60385861e7760c94f4c87b46
SHA1 hash:
03b90385b01e465d21c0570e329d52cd307160ab
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
61b9904ff8b3dd5d9817b889dc105290ddfba25d1e35c1b95fd21208281ba3d8
MD5 hash:
30e8c50c86277c3785c600357d1fef87
SHA1 hash:
4a8109d2103d9a140d67f1dd8524d2db41c8309e
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
SH256 hash:
41e82e314fceb906d8618dbaa5d622cdea1b453ed74e3d358b5aafee0030490a
MD5 hash:
34404cbd63be9620885368460b387695
SHA1 hash:
60c64006ee78c63eea23037213c1edaacfa59e88
Link:
https://www.unpac.me/results/84c49f26-5f07-4b12-a64e-a433eb138a72/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41e82e314fceb906d8618dbaa5d622cdea1b453ed74e3d358b5aafee0030490a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171508/

Comments