MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
SHA3-384 hash: d1b98d864ada10070f8f5f1e41af99a49253c90353d362b060e8014b17e0e07585866ce457ad69930ebfd57e64dc1632
SHA1 hash: bcef79da67710f2691a2f9f1d63815aa58fb8707
MD5 hash: 2f0cbfa0f285df217fac1faad59fa80f
humanhash: avocado-purple-bluebird-moon
File name:2f0cbfa0f285df217fac1faad59fa80f.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:29'103'632 bytes
First seen:2024-09-16 11:10:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9672ebf5bb7c1bcff5adba809443e5a6 (1 x NetSupport)
ssdeep 393216:lRPgWrgOSzU6QhcUkTb0LQvz1HaeNceuGznq6HZac4fFrPn:fPgWVOTwkrReeuGu6HUc49r
TLSH T124571281F2D2E464D441207132AB633B8D351D20532EC4F7BBD93E598A36AD26F7F692
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
File icon (PE):PE icon
dhash icon e0c4a098e998dce8 (1 x NetSupport, 1 x Rhadamanthys)
Reporter abuse_ch
Tags:CYNC LIMITED exe Isoo Backup NetSupport signed

Code Signing Certificate

Organisation:CYNC LIMITED
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2024-07-25T14:42:47Z
Valid to:2025-07-25T14:42:47Z
Serial number: 0fa27d2553f24da79d1cc6bd8773ee9a
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Central Blocklist:This certificate is on the Cert Central blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 4d94172af32e228957d25d3059686d666875a037b226224c54e7479e1749ad3d
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
NetSupport C2:
172.86.75.66:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.86.75.66:443 https://threatfox.abuse.ch/ioc/1213420/

Intelligence

File Origin
# of uploads :
1
# of downloads :
460
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e8124c71e91b3281ba0b45
Tags:
Generic Infostealer Network Stealth Wacapew
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug certreq crypto expand fingerprint lolbin overlay packed
Link:
https://www.filescan.io/uploads/66e8124a0883d6a903eb7cfe/reports/f4a58836-cc2b-4701-a87c-a18e9c36decf/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
Result
Verdict:
UNKNOWN
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
spyw.evad.rans
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1511810
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Delayed program exit found
Detected unpacking (creates a PE file in dynamic memory)
Loading BitLocker PowerShell Module
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1511810 Sample: 8hN4C25a0O.exe Startdate: 16/09/2024 Architecture: WINDOWS Score: 52 53 geo.netsupportsoftware.com 2->53 57 Multi AV Scanner detection for domain / URL 2->57 59 Suricata IDS alerts for network traffic 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 8 other signatures 2->63 9 8hN4C25a0O.exe 82 2->9         started        12 Videoconverter.exe 2 2->12         started        14 Videoconverter.exe 2 2->14         started        signatures3 process4 file5 39 C:\Users\user\AppData\...\Videoconverter.exe, PE32 9->39 dropped 41 C:\Users\user\AppData\Local\...\xvidcore.dll, PE32 9->41 dropped 43 C:\Users\user\AppData\Local\...\webrtc.dll, PE32 9->43 dropped 45 47 other files (none is malicious) 9->45 dropped 16 Videoconverter.exe 1 40 9->16         started        21 WerFault.exe 16 12->21         started        process6 dnsIp7 47 172.86.75.66, 443, 49743 AS40676US United States 16->47 49 8.8.8.8, 49745, 53 GOOGLEUS United States 16->49 51 geo.netsupportsoftware.com 172.67.68.212, 49744, 80 CLOUDFLARENETUS United States 16->51 31 C:\Users\user\AppData\Local\...\tcctl32.dll, PE32 16->31 dropped 33 C:\Users\user\AppData\...\remcmdstub.exe, PE32 16->33 dropped 35 C:\Users\user\AppData\Local\...\pcicl32.dll, PE32 16->35 dropped 37 5 other files (none is malicious) 16->37 dropped 55 Adds a directory exclusion to Windows Defender 16->55 23 cmd.exe 1 16->23         started        file8 signatures9 process10 signatures11 65 Adds a directory exclusion to Windows Defender 23->65 26 powershell.exe 23 23->26         started        29 conhost.exe 23->29         started        process12 signatures13 67 Loading BitLocker PowerShell Module 26->67
Score:
45%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-09-12 08:55:28 UTC
File Type:
PE (Exe)
Extracted files:
369
AV detection:
10 of 38 (26.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3bkzrub3iczp3vtbjakgtk5cbkbkkyy5mphp2oafjg4o7adbgcq._file
Verdict:
unknown
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery persistence rat
Link:
https://tria.ge/reports/240916-m99kmsthkd/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
NetSupport
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c4f9c4d4-0db8-43bd-bafd-dd17c606c24c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:HUN_APT29_EnvyScout_Jul_2023_1
Create hunting rule
Author:Arkbird_SOLG
Description:Hunting rule for detect possible Envyscout malware used by the APT29 group by patterns already used in the past
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::InitializeSecurityDescriptor
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::SetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleA
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetConsoleMode
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFile2
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertDuplicateCertificateContext
CRYPT32.dll::CertEnumCertificatesInStore
CRYPT32.dll::CertFindCertificateInStore
CRYPT32.dll::CertFreeCertificateContext
CRYPT32.dll::CertGetCertificateContextProperty
CRYPT32.dll::CertOpenStore
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::WSACloseEvent
WS2_32.dll::WSACreateEvent
WS2_32.dll::WSAEnumNetworkEvents
WS2_32.dll::WSAEventSelect
WS2_32.dll::WSARecv
WS2_32.dll::WSASend

Comments