MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e
SHA3-384 hash: 0c9b3a5ed02e29a897821ea3ca34b835147816d14dc6078d6476639f1c51e54882f039458f2dee6b091a92de87a932ca
SHA1 hash: a2be37d7aeb1fbbd799281f13712e87a1c754f26
MD5 hash: 1ffc64ec6ed254a5d35e5a00da90eee6
humanhash: east-glucose-carolina-emma
File name:10062022154159-0001.xls.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:2'561'156 bytes
First seen:2022-10-19 20:53:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f3173778f088ce2b56b8257bfe393419 (6 x NetSupport, 1 x njrat, 1 x RedLineStealer)
ssdeep 49152:Tp4MpbDJ+SYCDOWmNTJkLa3unnRawt9Amzn/h1A0Ihh7G2MUVJtYtyj:Tp4OYzWCTJfenRaA9pznUfhhkUVfYtyj
Threatray 434 similar samples on MalwareBazaar
TLSH T1DAC52365FB8140B2D963553198E4CA29DA74BC31AE77810FFBAC2B1E2E31ED18715B07
TrID 76.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
9.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 33f2e0ccc8f0f262 (1 x NetSupport)
Reporter GovCERT_CH
Tags:exe NetSupport

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
netsupport
Create hunting rule
ID:
1
File name:
10062022154159-0001.xls.exe
Verdict:
Malicious activity
Analysis date:
2022-10-19 20:54:42 UTC
Tags:
unwanted netsupport
Link:
https://app.any.run/tasks/a017fe51-2f98-4f88-9440-7935cdb3f968

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/321838/
Detection(s):
SecuriteInfo.com.Program.RemoteAdmin.837.11923.27396.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Pseudosigner-36
Create hunting rule

PUA.Win.Packer.BorlandDelphiKo-1
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.6774.30868.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.3564.9146.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.837.19536.7356.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/635063ec455bf4ac5c716608/reports/f98ca097-bcaa-40b4-804e-8617f0d2df82/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70e2d22e-a2e8-41b2-b0de-e4e28c370dd5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1093795
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses an obfuscated file name to hide its real file extension (double extension)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e/
Threat name:
Win32.Infostealer.ChePro
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 09:57:14 UTC
File Type:
PE (Exe)
Extracted files:
478
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2ztzp7olewtjrdxhucp6hj2a26jtums3my32eduvaooew65aspa._file
Verdict:
malicious
Similar samples:
28fb68d0fc8e305257af9613cf9cfeeb65d12379a7672541f7b3add0a58562a8
NetSupport
6a9677534228b1e25cb6b978f465b98c19b08844ea9b559e7538f7ff45bb04c8
NetSupport
b9c3dd797d2a590da62c4824d658ad8decf1ed1ffa77bfaa47f3f12966757a0d
NetSupport
bad534540ed575c213bd34fe1f21c6ffca58169e9c9c83669749c3f6e398ea4b
NetSupport
c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f
NetSupport
d2f9dc8e7278a2ec0aa634536ac8d23db209aba8ca0e109ce80469c27517ab33
NetSupport
+ 424 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport rat
Link:
https://tria.ge/reports/221019-zpvxzagdf6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Loads dropped DLL
Executes dropped EXE
NetSupport
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/00b43e2c-9327-4b6e-b8c1-96de34d62cc7
Unpacked files
SH256 hash:
2d32633850e0cfdb0a5be88d76c56c815c6d4a5743aaeecf8284f9cfc3db0371
MD5 hash:
30f08732ad774274c53e06cdd27befdb
SHA1 hash:
e81dfcdad5e1358dd6939b848728bbd29574fdc5
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
e937a45d2fb357abca8db8bf35c0ee4a891dc325884e768ffdafc9dd0dcceed3
MD5 hash:
20de7e4ec959b34f10d922a48499053f
SHA1 hash:
e5517d8d910f1c51210f00184f9b5c20030b609d
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
b7d70069462ef758c6c00138bb3ac675b89e1d6611dddbdf2b9e4b401efca79e
MD5 hash:
f802e696442d9e8cfdbb688fb0d73be9
SHA1 hash:
adb90d478d1e812e19bd753aeb8fee3cc619a03b
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
bc058b77c23b10addcec434e01acb92f1f9a525f6a389352818d65005991e015
MD5 hash:
47b00a8fd4fbe9635d244c1665e53c92
SHA1 hash:
902f427e4518327b8e113dfc269be16161fec5a8
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
ba00c41ebdc366c7fb51149379923b21816e7fa3d2a44e2854d11f47e3a7ff57
MD5 hash:
eae5e4fcbe40154d5527befdb307679b
SHA1 hash:
89cbfc8c69648f9b3120239fcd927eb27977ccfc
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
5312459a8c8015d41059759e53cb0e66e51ca17f79f0ca50c9c3f792e8368db8
MD5 hash:
294150cffba9353066b5396eba1d3485
SHA1 hash:
6c7c91ed6cfb9501b6bb0209300e4278730c36c0
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
SH256 hash:
a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e
MD5 hash:
1ffc64ec6ed254a5d35e5a00da90eee6
SHA1 hash:
a2be37d7aeb1fbbd799281f13712e87a1c754f26
Link:
https://www.unpac.me/results/344ed607-26cd-454d-9a93-ace85f22ce50/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetSupport

Executable exe a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/321838/

Comments