MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed
SHA3-384 hash:	c09e90176ca86b9b6cdba3212c6c2c63c61060a7b874a36607bfa12b5e2eb6c93463a9f4951124d70288059beaaee6a0
SHA1 hash:	e70ff877a5799464f0ee057676858b37d1a4f2bd
MD5 hash:	1497ee62ae8d86dfd030267cf3d29f91
humanhash:	utah-april-asparagus-queen
File name:	1497ee62ae8d86dfd030267cf3d29f91.exe
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	2'197'933 bytes
First seen:	2023-07-15 18:25:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3eaa732d4dae53340f9646bdd85dac41 (11 x NetSupport, 6 x RedLineStealer, 4 x ISRStealer)
ssdeep	49152:VB6Ibm7IGGPVc9owLuHj2sST+rkzDFzuGRINd7wAfr4D:r6GLu9SD23+64RF4D
TLSH	T1C4A523636280D071F47B9075CF6EE391E9B8BD3522318143B7903E3DAA769A1DB16F21
TrID	73.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 8.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 4.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.6% (.SCR) Windows screen saver (13097/50/3) 2.9% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):
dhash icon	1a79f0f8ecf8f970 (1 x NetSupport)
Reporter	abuse_ch
Tags:	Dfaiernewa23.com exe NetSupport

abuse_ch

NetSupport C2:
185.212.44.49:1237

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

325

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN netsupport

Malware family:

netsupport

Alert

Create hunting rule

ID:

1

File name:

https://github.com/DesmondFeil565/filmb/raw/main/MBIF_Letter_information_july_details_pdf.zip

Verdict:

Malicious activity

Analysis date:

2023-07-11 00:31:58 UTC

Tags:

unwanted netsupport

Link:

https://app.any.run/tasks/f7f40980-e284-44f2-8111-072095504342

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/420676/

ClamAV Detected

Detection(s):

Win.Trojan.Starter-287

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

DNS request

Sending an HTTP GET request

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm cmd control cscript evasive explorer fingerprint greyware keylogger lolbin lolbin netsupportmanager overlay packed packed remote remoteadmin replace shdocvw shell32 virus wscript

Link:

https://www.filescan.io/uploads/64b2e4bbfd9e198dc11468a0/reports/2fe00a80-5832-4deb-8e65-66b686a5e847/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer NetSupport Ltd

Malware family:

NetSupport Ltd

Alert

Create hunting rule

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7d37b269-8dc4-48a6-afb5-a58e50a67d9f

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1273661

Signature

Contains functionality to modify clipboard data

Delayed program exit found

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-11 03:47:44 UTC

File Type:

PE (Exe)

Extracted files:

463

AV detection:

21 of 38 (55.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=snucvlbu6hkiku77axiir4rfeef23htj5i7pw5o2gny5bfvkf7wq._file

Threatray malicious

Verdict:

malicious

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport rat

Link:

https://tria.ge/reports/230715-w26nfscd81/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

NetSupport

UnpacMe 7

Unpacked files

SH256 hash:

a59d18582b47c208f58d68135e43b441af933f65c1a08603b9f2f5fd8d791406

MD5 hash:

25561950ca1f28931585673fecc51c78

SHA1 hash:

fefab3745930773a5d96982e01c54169bc064882

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

074bfd175fdc34ca7cb398559c48b45df4adf1487c914b397da79222fb5398c6

MD5 hash:

88c76b30a77ed20a90e347f12496e53e

SHA1 hash:

620b6cab2a224d5399c09d87e5987420e6a8fa33

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

f25eb634568acfc1245781aba6855d5f8ff2fa98e3908afb382c8d01550d251a

MD5 hash:

4730c6d93af8efe5d05fed1b93f8ba62

SHA1 hash:

43f0a18a65430fac64ebb84388f8a3fecb5f02c0

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

fa3811a65d194a1d28ce9d85e3ca06b4c4691a5241bed7d885ec3128c780669c

MD5 hash:

7639c11600470257b40003369d42a17d

SHA1 hash:

333b7b9cb25cf66ad1d9186379956f8620682a8c

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

6e720ea9eaf790bd3bfd0b9538116f859d075cb21372730b3b61c523cb223ab5

MD5 hash:

c1e217cbfdebbe6efda449483ed26184

SHA1 hash:

266fa8bfc609caa23cf9d58b83503bcacd605591

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

6c1ee07f1873a7aaa71e484cb6935684972ecead230089e9b93af8821daa12e9

MD5 hash:

912e86bf7d3d18edba8cf1a8c1ef4714

SHA1 hash:

c5164c893261613cd21e57ba877dab9920eb310b

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

SH256 hash:

93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed

MD5 hash:

1497ee62ae8d86dfd030267cf3d29f91

SHA1 hash:

e70ff877a5799464f0ee057676858b37d1a4f2bd

Link:

https://www.unpac.me/results/dab5ff0a-b776-4ba5-b473-3dfed7179b24/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI NetSupportManager RAT

Threat name:

NetSupportManager RAT

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/93682aac34f1d48553ff05d088f225210bad9e69ea3efb75da3371d096aa2fed

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/420676/