MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ff4eee309ee1ba1e6f2313f926a8b388d536dc3f64e1dc8ecc734fe4b87e8f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ff4eee309ee1ba1e6f2313f926a8b388d536dc3f64e1dc8ecc734fe4b87e8f1
SHA3-384 hash: 5f269b4cfb78385b3e851938ebd210cb925f8c63d1875f8b5077bbb95180e0e300618b04cfd894356577610fd59921df
SHA1 hash: 832564162cc2baf9fd346bd12c1feae14c30960a
MD5 hash: 4068002fff6b193720a65cccd947d378
humanhash: tennessee-fruit-butter-don
File name:file
Download: download sample
Signature NetSupport
Create hunting rule
File size:2'796'334 bytes
First seen:2022-12-09 12:25:14 UTC
Last seen:2022-12-09 12:35:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f3173778f088ce2b56b8257bfe393419 (6 x NetSupport, 1 x njrat, 1 x RedLineStealer)
ssdeep 49152:KwW7MpbDJ+T4CDOWmNTJkLa3unnRawt9Amzn/h1A0Ihh7G2aUV5tYty5:Knf4zWCTJfenRaA9pznUfhhyUVPYty5
Threatray 452 similar samples on MalwareBazaar
TLSH T19ED502E7A8C20165D8392D384E52A838D277EE7E7B786001F6A17D35FB33B82C56D506
TrID 73.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
8.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.6% (.SCR) Windows screen saver (13097/50/3)
2.9% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):PE icon
dhash icon 86aea494b4ac82c6 (1 x NetSupport)
Reporter andretavare5
Tags:exe NetSupport


Avatar
andretavare5
Sample downloaded from https://vk.com/doc768409605_652126687?hash=B6ko0e3rEdDE457EfRgX8sqyJM6oKT6CpG9dQtsHVCg&dl=G43DQNBQHE3DANI:1670588465:C3JEkpCkKDE9GmKBRTWxx0RZvKZYhfOlkYEzpCzmr2P&api=1&no_preview=1#t

Intelligence

File Origin
# of uploads :
4
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344695/
Detection(s):
SecuriteInfo.com.Program.RemoteAdmin.837.5527.6438.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.11923.27396.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Pseudosigner-36
Create hunting rule

PUA.Win.Packer.BorlandDelphiKo-1
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.6774.30868.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.3564.9146.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.19536.7356.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Enabling autorun by creating a file
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/6393295c9a505ad9423e7303/reports/a0be34c3-ced1-421f-b086-f046767b91dc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetSupport Ltd
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/845c7535-befe-46fd-8d11-befb9f4960db
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1131392
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ff4eee309ee1ba1e6f2313f926a8b388d536dc3f64e1dc8ecc734fe4b87e8f1/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-12-09 12:26:14 UTC
File Type:
PE (Exe)
Extracted files:
473
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p72o5yyj5yn2dzxsge7ze2ulhcgvg3od6zhb3shmy42p4s4h5dyq._file
Verdict:
suspicious
Similar samples:
23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb
NetSupport
28fb68d0fc8e305257af9613cf9cfeeb65d12379a7672541f7b3add0a58562a8
NetSupport
5a7de361bcc0ff503cf974023547853abe74c8bc336bcd04983dd42a39b4015a
NetSupport
6a9677534228b1e25cb6b978f465b98c19b08844ea9b559e7538f7ff45bb04c8
NetSupport
bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
NetSupport
c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f
NetSupport
db001e5eed23e82bc4bdd96f95d6db26e8209a087a6a09ea5434346b3d7e7856
NetSupport
fb76386ce3f17a25d59046a70cc05898bcccc7422ab92681777071e46d8943e5
NetSupport
+ 442 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport rat
Link:
https://tria.ge/reports/221209-pl66qadb62/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Loads dropped DLL
Executes dropped EXE
NetSupport
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/979937e9-dc6f-42a2-8d09-2ecd7d1aee4d
Unpacked files
SH256 hash:
9dd994694200780c9c395c8fb08c6b6055c2107df52b23654c95e24c42fd57fa
MD5 hash:
723cab3bc70833a3e2a6d60573c0d34d
SHA1 hash:
bca468b3988930351b288bf41135b945c7da8597
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
1ff257f7f8762a164a7a8b6e25e2c617e63e6da222ffd87dbb081fd5d1096e40
MD5 hash:
49cfb24cca86b1ba78ab8bf9fe56e96f
SHA1 hash:
6a790a748006e82e16a52af0df2cbb037a496707
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
170a81da6b4434e926c372d800dce26cbed711bb6d019776a7a5819fdfaf70ee
MD5 hash:
628a86e6f9644e191c1517507179e40f
SHA1 hash:
37b536eff4d22c80a41f063ecd992d220db883f0
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
cab60dbbde559f39b540bb203d0af9d222c499adde15f406ab88cf4eb161c898
MD5 hash:
872f3dc53ca97cd296ce16914a553b1f
SHA1 hash:
3606a8cf127940d714f4b64871656edf54a5b353
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
ed2f8ce24ecbfa1aa618bf150905c7bc49d9c8937ae16d6751fd4ebdfdf55710
MD5 hash:
9668311ba88d86bf4d950178f1caefdd
SHA1 hash:
1147d67d3423f322259c016260212a2c5b8a0114
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
7a1d8b0ed9b24b6dbd8aa362dbe992c1294ce4ba78698e779db3ef1bed127d62
MD5 hash:
8831185078d2848bb53bef8cb004e96b
SHA1 hash:
0e21da895599afd50ad01b2644ec26160cd68063
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
SH256 hash:
7ff4eee309ee1ba1e6f2313f926a8b388d536dc3f64e1dc8ecc734fe4b87e8f1
MD5 hash:
4068002fff6b193720a65cccd947d378
SHA1 hash:
832564162cc2baf9fd346bd12c1feae14c30960a
Link:
https://www.unpac.me/results/f9d939a7-e227-45d9-b256-aee4b14ac555/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ff4eee309ee1ba1e6f2313f926a8b388d536dc3f64e1dc8ecc734fe4b87e8f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/344695/

Comments