MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b4d61c536730fbab0d2d81ec2f7bf8cdda541e4fd9200ddf50cf773c90c019c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetSupport
Vendor detections: 13
| SHA256 hash: | b4d61c536730fbab0d2d81ec2f7bf8cdda541e4fd9200ddf50cf773c90c019c0 |
|---|---|
| SHA3-384 hash: | 0c403117a2989e764eeea9d919e9999edef37eb6d09fff5f0b82e59a7eeaeadb940e52feffdcd7eb8ce36b1f6ad4606d |
| SHA1 hash: | 8ab83f49f98b1188de7c52a5bd7bccc3f7b0bd8f |
| MD5 hash: | 15f7867fee9b4bbcb91168ecc52eb5d2 |
| humanhash: | colorado-connecticut-white-high |
| File name: | 15f7867fee9b4bbcb91168ecc52eb5d2.exe |
| Download: | download sample |
| Signature | NetSupport |
| File size: | 2'147'474 bytes |
| First seen: | 2023-05-18 16:16:33 UTC |
| Last seen: | 2023-05-20 14:48:43 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3eaa732d4dae53340f9646bdd85dac41 (11 x NetSupport, 6 x RedLineStealer, 4 x ISRStealer) |
| ssdeep | 49152:/BrdfcoIsGlR4EpZeYzg/6aU2/trEvGony/78Ro6:5rWBblR4oesg/6ajtovD28 |
| Threatray | 410 similar samples on MalwareBazaar |
| TLSH | T113A523A13AC5C07EC52759B08DA9D7A0A9293C659B710687FB90372D3B3F9C2D325B07 |
| TrID | 73.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 8.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 4.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.6% (.SCR) Windows screen saver (13097/50/3) 2.9% (.EXE) Win64 Executable (generic) (10523/12/4) |
| File icon (PE): |  |
| dhash icon | 70f0a4e486d4f0f0 (1 x NetSupport) |
| Reporter |  abuse_ch |
| Tags: | exe NetSupport |
Intelligence
File Origin
# of uploads :
2
# of downloads :
268
Origin country :
NLVendor Threat Intelligence
Malware family:
netsupport
ID:
1
File name:
15f7867fee9b4bbcb91168ecc52eb5d2.exe
Verdict:
Malicious activity
Analysis date:
2023-05-18 16:21:07 UTC
Tags:
unwanted netsupport
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm cmd.exe comodo control.exe cscript.exe evasive explorer.exe fingerprint greyware keylogger lolbin lolbin overlay packed packed remoteadmin shdocvw.dll shell32.dll virus wscript.exe
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.ChePro
Status:
Malicious
First seen:
2023-05-15 15:42:03 UTC
File Type:
PE (Exe)
Extracted files:
465
AV detection:
18 of 37 (48.65%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 400 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Score:
10/10
Tags:
family:netsupport rat
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
NetSupport
Unpacked files
SH256 hash:
bf831349c8ab4bcc293ec733d308164f3442e6f0fe3b4b41d75071e39e76938b
MD5 hash:
5a0b88b183d9bf68e69b8d11cfb79ea5
SHA1 hash:
c37367b00d6e75f50319ac7a99834523d1b56adf
SH256 hash:
5871b7e630b48d66db932648fba8c7eabef94d7d6b304fdab489073b818c7ef3
MD5 hash:
6de5c8a1ee4d9aba68cb5773c010a8e9
SHA1 hash:
c15b17f5e7cd67870a45d7a078cbb1653ce49d26
SH256 hash:
209c0d6356baede4f5fa9f7719b660283abf2e0a8ee26a165c327989a85709da
MD5 hash:
f99ecc4cbf741fec9c6b5c3285603980
SHA1 hash:
a04b12572bed4df10a33b5c8fb8755ea05f6dc33
SH256 hash:
b10ce7b8261a40e75c24f1bae411e5d2d42cfa1aab3025f64d09885cf095b7e1
MD5 hash:
2911c6e8873d65bbf4e7635f5453ddd9
SHA1 hash:
8266e3aaef15cf5e6d6e8fb4bdde9178bbf8789f
SH256 hash:
6e720ea9eaf790bd3bfd0b9538116f859d075cb21372730b3b61c523cb223ab5
MD5 hash:
c1e217cbfdebbe6efda449483ed26184
SHA1 hash:
266fa8bfc609caa23cf9d58b83503bcacd605591
SH256 hash:
448c54a782f3e4fa8cb163a30a701a61ceb84e1840fd32ad5da473a84405c1fa
MD5 hash:
46c286096f9cc86eaee9c0824cea1ccc
SHA1 hash:
0f3a7a56b62ce7c939501eb908cf72585eea9dc4
SH256 hash:
b4d61c536730fbab0d2d81ec2f7bf8cdda541e4fd9200ddf50cf773c90c019c0
MD5 hash:
15f7867fee9b4bbcb91168ecc52eb5d2
SHA1 hash:
8ab83f49f98b1188de7c52a5bd7bccc3f7b0bd8f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.