MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b
SHA3-384 hash: 8ef52f1b75d77ef9eef0088841d934c814b5a4cc486981341dfd84a11586437db84387c4cf7a3888bf75f1825873b97e
SHA1 hash: cb90a671151806ac1044960f13c39bc5213696e2
MD5 hash: 665cbb22ed01ecbbec6eed5c400bb701
humanhash: fanta-equal-oscar-glucose
File name:665cbb22ed01ecbbec6eed5c400bb701.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:254'976 bytes
First seen:2022-09-15 16:25:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 03dd9b96cbd373e55c598baf355bc45a (1 x NetSupport, 1 x Smoke Loader, 1 x GCleaner)
ssdeep 6144:HDZ5LIi0Vgg9jCgkPBhbxGFAq07hiniga:HDnc7Vgg9jCgkhb++7ki
Threatray 6'603 similar samples on MalwareBazaar
TLSH T1A644DF367692D471C0920D304876CFE1267FBC226A34864BF3A67B4E7E7239066A535F
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 38b078cccacecc53 (13 x Smoke Loader, 2 x DanaBot, 1 x Stop)
Reporter abuse_ch
Tags:exe NetSupport SmokeLoader ysanhumeg1-com


Avatar
abuse_ch
NetSupport C2:
5.45.72.55:2970

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.45.72.55:2970 https://threatfox.abuse.ch/ioc/849851/

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
665cbb22ed01ecbbec6eed5c400bb701.exe
Verdict:
No threats detected
Analysis date:
2022-09-16 07:00:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bc270776-3359-4b2f-9010-3dc874e3072b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/310309/
Detection(s):
Win.Packed.Tofsee-9951336-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Launching a process
Setting browser functions hooks
Unauthorized injection to a system process
Enabling autorun by creating a file
Unauthorized injection to a browser process
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/37740/overview
Behaviour
MalwareBazaar
CPUID_Instruction
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
greyware packed tofsee
Link:
https://www.filescan.io/uploads/6323525b36ccf428b25e56aa/reports/51f7198d-455b-4f06-b18c-e394e25e85f3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/146c3d19-ba45-4213-8220-8664ca70c2b2
Result
Threat name:
RedLine, SmokeLoader, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1071098
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 703641 Sample: 3RIXa4QCaw.exe Startdate: 15/09/2022 Architecture: WINDOWS Score: 100 81 Multi AV Scanner detection for domain / URL 2->81 83 Malicious sample detected (through community Yara rule) 2->83 85 Antivirus detection for URL or domain 2->85 87 8 other signatures 2->87 9 3RIXa4QCaw.exe 2->9         started        12 ergcerd 2->12         started        14 ergcerd 2->14         started        process3 signatures4 109 Detected unpacking (changes PE section rights) 9->109 111 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->111 113 Maps a DLL or memory area into another process 9->113 16 explorer.exe 4 13 9->16 injected 115 Machine Learning detection for dropped file 12->115 117 Checks if the current machine is a virtual machine (disk enumeration) 12->117 119 Creates a thread in another existing process (thread injection) 12->119 process5 dnsIp6 61 anonfiles.com 45.154.253.151, 443, 49762 SVEASE Sweden 16->61 63 212.192.246.101, 49767, 80 RHC-HOSTINGGB Russian Federation 16->63 65 9 other IPs or domains 16->65 45 C:\Users\user\AppData\Roaming\ergcerd, PE32 16->45 dropped 47 C:\Users\user\AppData\Local\Temp\9BF3.exe, PE32 16->47 dropped 49 C:\Users\user\AppData\Local\Temp\8E17.exe, PE32 16->49 dropped 51 4 other files (3 malicious) 16->51 dropped 89 System process connects to network (likely due to code injection or exploit) 16->89 91 Benign windows process drops PE files 16->91 93 Injects code into the Windows Explorer (explorer.exe) 16->93 95 3 other signatures 16->95 21 62ED.exe 16->21         started        24 8E17.exe 16->24         started        26 9BF3.exe 16->26         started        28 12 other processes 16->28 file7 signatures8 process9 file10 97 Antivirus detection for dropped file 21->97 99 Machine Learning detection for dropped file 21->99 101 Writes to foreign memory regions 21->101 31 AppLaunch.exe 21->31         started        103 Allocates memory in foreign processes 24->103 105 Injects a PE file into a foreign processes 24->105 35 AppLaunch.exe 2 24->35         started        37 AppLaunch.exe 2 26->37         started        53 C:\Users\user\AppData\...\remcmdstub.exe, PE32 28->53 dropped 55 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 28->55 dropped 57 C:\Users\user\AppData\...\msvcr100.dll, PE32 28->57 dropped 59 6 other files (none is malicious) 28->59 dropped 107 Multi AV Scanner detection for dropped file 28->107 39 client32.exe 28->39         started        41 powershell.exe 28->41         started        signatures11 process12 dnsIp13 67 t.me 149.154.167.99, 443, 49774 TELEGRAMRU United Kingdom 31->67 69 116.202.179.139, 49775, 80 HETZNER-ASDE Germany 31->69 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 31->73 75 Tries to harvest and steal browser information (history, passwords, etc) 31->75 77 Tries to steal Crypto Currency Wallets 31->77 71 ysanhumeg1.com 5.45.72.55, 2970, 49776, 49804 SERVERIUS-ASNL Russian Federation 39->71 79 Multi AV Scanner detection for dropped file 39->79 43 conhost.exe 41->43         started        signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-09-15 16:26:09 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=suftjdeqsbqqkzzy5bnc6zc2xrvd6pxxdil2xes22pqss6bccrnq._file
Verdict:
malicious
Similar samples:
05bb07f3dfae2584a5f6382f23ba58bbea9feeea01509c446a1c75e47a9dfa13
NetSupport
133d64f6ee01377be8697b09749f5c989206a86e5e06243561376bfa8a31dcb6
NetSupport
496e0e9f8c0f4239f5ef32035a628fba3179722ae147e016ae72ae3a6d067433
NetSupport
7b53def5f8927c76ab3d102222b8cec2e5d74cd0529873c7f416ecef7855a830
NetSupport
b534f2d22a5f8a0e2acfdb77bc21e3c13172725a4bb9a8a1e22cf89dfb16a727
NetSupport
bba622f07411673517d523dbc455aaac235c556619a15fd9878a9b8ec560c6d7
NetSupport
e6f32af1deec9f4ea14c9507c413349135cd26b59563c39acda47eb77b14b420
NetSupport
+ 6'593 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:netsupport family:smokeloader backdoor rat spyware stealer trojan upx
Link:
https://tria.ge/reports/220915-txhpqadfa9/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
Detects Smokeloader packer
NetSupport
SmokeLoader
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7298c77d-38a8-4071-a7d0-0d1987a396b2
Unpacked files
SH256 hash:
7373b3de84c4d72268c6a240c167b9c63bc78b51fd714263a75e0f51a67cf110
MD5 hash:
ad8be116b00c2d14c1a172ca4b1e2d41
SHA1 hash:
a334e7ee935cc2b18ca644628c9a7a432275185f
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/0af0802b-ca99-4d64-b21f-ee2972eedf21/
Parent samples :
a7f8a7823e07753434f6ea1e082c5a8c98f6499acd807a50698cd6832101c105
af7af8ac48c25bcf0a40d6eb4c509b513bc6d6c5f4ac0ce6ca5e6ab39713cead
0415805018d38301c22d1fbb3c706139e9741c9dd9b7f0ee48305472642bbe93
3c634ef22177b0460a3f9eda7c0320292604c3ba13029955761ea2b6522d3c1f
5c152d1a379fe3df07a2d57315856f8e17997ee6490351116599ec78e9c5fadf
5c1b807913b1a6b8c14a004a2b1830ccc10c61c3b54b16c32faca280360c805b
91da5beb7f92e7ed9e92648850b664423181cafebcdd6b9e6bfe3f4c492316bf
694b13a1ac031d126c57a4eb7d31b2eefef733bc082887153c8548f1b8dbe4b8
9da402ec64e5fb3f497a056a8c8b93b43a9ed46aac3205500a115f4df0119beb
77bb17e210609671e2a17a5734309333bc2a9f9a70e2e176f4a08f7bb298acbd
29079fb6fda6a5e7e2517abe288e52c215b7bc5ba626689598f3fd9046e39838
aeb7ba72e2e9967fd1a151cbc6be4d72a69c52f4770cc403302f694499402a9e
9f3e6995563f1814b28bd7dd3cfc899026fb75f7d4324337402e2ac2b97ad54d
0530826fbe1eed7dc8c921c713eedf5959223d49c4dd751eb072a1dee259f641
ca04c38831cf9a279ae0e785aa3b7a6674ca9da0896b30fb93bc6e3c624aac38
397911aa6f8bf71959828994ac937a025d52160f514f7310eb5118d7ccc5fbf0
23a4205b89963d887bff1a7d5f4edede1aad79612080a8294321457575807446
19e454bcc7561f4554de70d446db8f692597f7bebc1bf76edb12064e73f50c77
548a58834a56b6b482a382cb4a2818a1f4a8e0bfaf6592bce82219282239141a
e6f32af1deec9f4ea14c9507c413349135cd26b59563c39acda47eb77b14b420
4ea78a76cc5d9246cef41b1f969023406069c176ccd85b756b81a2ff333e7de3
496e0e9f8c0f4239f5ef32035a628fba3179722ae147e016ae72ae3a6d067433
133d64f6ee01377be8697b09749f5c989206a86e5e06243561376bfa8a31dcb6
bba622f07411673517d523dbc455aaac235c556619a15fd9878a9b8ec560c6d7
7b53def5f8927c76ab3d102222b8cec2e5d74cd0529873c7f416ecef7855a830
05bb07f3dfae2584a5f6382f23ba58bbea9feeea01509c446a1c75e47a9dfa13
b534f2d22a5f8a0e2acfdb77bc21e3c13172725a4bb9a8a1e22cf89dfb16a727
cad30ad3dc657a39b8e8625ed7d40ae81f4ad7808021758ddbed1990227403e9
d6e42e2a61096c2e8cddc89fb51ccd964a573bb87d3a63a22a2becac0640f279
e40d22332ea475ceef424d78960054ad7586f0f6e462c61400eb463612e591c4
7ecd8a8db3343a68ef4cf73da7b3208a30296c3fe0bb05c55409c33017474dd2
93fa985753a73dbeeb8b6fabebc0054a4aefbf16a811d37c6e1a89c51671c059
74334bd66296cd06cceb1f3fb116dca85a598c6bef3d646f108164edb61498bc
675fd5dc0b60f4210f218e3726f9c47c26a23a0eb796ea73a3c0eb8de7355770
74b329e9e0c0027a37427256ad36933c097002aeac548367a711775760b9d820
1d29f91a68222f8af7f6a8f175bd0789518eb8efb031157169d75e2d1a0f016d
e387e0ba5e2fb9355e78d28a92edff5479c15e327f6e4e97a3cf42c27e00e85f
2320f94ee4c8f232af6ba8fba793d80a1df3d17e43c0bfb3ad1cd7b9ac39edc0
829f67338d9165358ffdab748662e90f6f6962711dee0e670faacd61517d20ff
57b951c6681ac70f024e8e1bfb17010eba5828256448b3e3dff1afdebe55f8b7
d5b7a3f86c10c1cd99b32cf871c0ddb8d1fd2c3296c0094e263f162079c94b9b
08e68ce328c5bdde9980064734860e13523dc3b4cad8293d8503f0cc27629a4c
6a2facafe3db2d714aada4694fd93dd0b06f00739e4c7f374d61a2b6d8d80685
766c1956fa1216c5ca19232e01ed4f2a79447cf227988ae5834ea1ede5639a21
e8d2f8588a0e4d082c25e18c02828dc9895084c59872fbac8b4892c6ba36f502
f480354863d1831cde4df3603bc48b51e81e6a644cc4220b4425465dbd3f1fbc
2540f6f96c7686299fcd27c4e17a9191e107b4e65a7c32ed1d290775e96d9bd1
9b5e905b2b8c43a563b7cec56d72bb8cff5337ed92f87dfeb8c7db1e602679f9
1dbc3fc77a4cc5fffe4ce63d0490d832344bdedbe5940cb3ee77d67564a66184
52512ea5650fe9a5dc35813c72cf7a6c2b4638dcdc591e9e796a108be8492c13
c2bdddb56dd15b84a41b300ebc0801750e942edf7561357a89ef9616d4b2520b
2cf23645ad7e038599fd2f1e3336e07b1aca6f2f94916468bddf4f8e4273709b
c48968a646809b11a1ea796d3882bd6e3a1470bf124c1c25e86d27855d0df0a3
c50af8cb441e0d7aa9a5f7a4d74ded2ffb2f6234c3642b69c4093cc84d458e78
9bdbe4fe72c08a175a7ecf0eb7e1b6bdbe54b29e1eeb021d06c1d75a6ccfdde5
43d7799efd24b0d79b449af6101f93868703f6e70cda71eeac256ff01eb39fa6
8fec0d4a1db431baf98dcb64b2599e2ab0333a4ed0ae82fd944236f96c574e08
8c28e05ef7050aebe9fe7c85912f14df08899828edbad1a15aabf52d6c8b4d4a
514205bc5501a947f851a61ac9e7b6eef3e60ca670fd10c7d67352fdbea3123e
04b3705de90b1c5495e40a491fc0692837643fe678a0800ca3bf8dd59db964df
765aced02aae90f6835bf0c5403723c801f744608ace63c369c12c32e4923db2
950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b
7d1b7170ad2e8bdfb48fa1cf510dfc08cdc7a1b7153626bb63698fc6a07013c4
96e51aa528982771c3f9c3b69415317550089f1a347a3588e13bd1b4c3aac8d1
0b39538e364fbe89db0c425838a16445e214d4e59c8c4bfe983b5f44018fc903
322e0af514ac471e5d6d653caa3bdc9f22a5e8bc67cf66ffa7cf498b03284722
11c09ce77034a8d1d15f83167564894d4131f904f2b0e27fce22b6c3d9cffdfe
aa7d34a3b3789ec4ed21106ebbcd137c2704b83655924e77e56f7bad97463c84
a5016827ee95b0bd04a17794273b47cd88dc03a0dbc74e67370c325864d8a11a
3e640feeeff380c6022b56ccbb0bc74de5ef30c9ab348c0b5f7e4c698ed0d400
7ba77fb4cec8eb8b6264fa7ba0778d7c9ccb7f99a50a2ec97f65ac9b6755be71
f62cc7b73ee140dda34c28f6c435dce2885fa618e9291759f1651cc3eb2a80ab
1712383427373945d7cf3fa2167b6cfc6c379e7c30fd102aaeffba1c46deec1a
27d1c1d99cdf25f9aa06dfc229d13010f7ce32584e0704f6dac23df4d1aca664
18baada5c4fee8726f10848be871743a23735474c5df877d3e4206c3e30e531e
b59605ff1e997171a997bb380245239829c8b87e26846e6612241afa85b542ee
3cd35bf5e13b5f49216c88968e9add8a36c5c02d06ff5b7018f417dbc42a7ae0
6c448e6fdefdd22d8d492fa5055bfca02297a8765c979658f5dc84f6f47123db
6fd984a05a49425c0eac9c80444f80eeb991a4b34d91a209100fa4df902afa95
f9ab6d461679c319c17f451d8036ed1ace4f891fbf706fef2fd760a551f8e339
0e5b16c6d12e37ccf7567676bf15f3220ca0c4f31cff6e0d2d02c8a5cb4ce34e
9d7c055265b3367c1e24792fec28c23df43262fc50da88a7696283c923fdf4b7
47be09383f1ccaf2af48e96ae25965b61547195fc11cee958400ac464983cf2b
d41a8bd001feda9ad29b5178cb438c2e23fc4fb9775929b3885fc54d424ef929
SH256 hash:
950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b
MD5 hash:
665cbb22ed01ecbbec6eed5c400bb701
SHA1 hash:
cb90a671151806ac1044960f13c39bc5213696e2
Link:
https://www.unpac.me/results/0af0802b-ca99-4d64-b21f-ee2972eedf21/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetSupport

Executable exe 950b348c909061056738e85a2f645abc6a3f3ef71a17ab925ad3e1297822145b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2303568/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/310309/

Comments