MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b6a0cc1e5488c0c9f1429d1744f8c2f81f7dce4229b8322fbdad043cd9084b1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetSupport
Vendor detections: 9
| SHA256 hash: | b6a0cc1e5488c0c9f1429d1744f8c2f81f7dce4229b8322fbdad043cd9084b1f |
|---|---|
| SHA3-384 hash: | 33311e64f7a48289cf37db01e2a19b9f30d521231957705408458d0407913c345aa24e7d4e6e75fb856d45f100543031 |
| SHA1 hash: | b00e619270665c52a6d51ab9cd119aceaa34cd24 |
| MD5 hash: | 88eb1f48be9f402a57f604c0a9aae82e |
| humanhash: | bakerloo-salami-illinois-pasta |
| File name: | B6A0CC1E5488C0C9F1429D1744F8C2F81F7DCE4229B83.exe |
| Download: | download sample |
| Signature | NetSupport |
| File size: | 2'595'840 bytes |
| First seen: | 2022-02-14 19:31:26 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 69 x LummaStealer, 61 x Rhadamanthys) |
| ssdeep | 49152:pEl3r2sbp0Y5B87b4ECTHj7BLWE8uT9hMVtYgtmQH2LIU/3Wwe/J9oMSMf:qqsbfKHwTHfBz8AmLfmQW3Wwe/J9gMf |
| TLSH | T1D8C5334EABD419AAE0768F704AB156C71A327C516B39C5DF668C8C3F6E233D06630F52 |
| File icon (PE): |  |
| dhash icon | f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader) |
| Reporter |  abuse_ch |
| Tags: | exe NetSupport |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 185.225.19.97:1203 | https://threatfox.abuse.ch/ioc/387766/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://bazaar.abuse.ch/download/b6a0cc1e5488c0c9f1429d1744f8c2f81f7dce4229b8322fbdad043cd9084b1f/
Verdict:
No threats detected
Analysis date:
2022-02-15 01:22:33 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Searching for synchronization primitives
Connecting to a non-recommended domain
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Possible injection to a system process
Launching a tool to kill processes
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack.dll control.exe explorer.exe packed rundll32.exe setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Phonzy
Status:
Malicious
First seen:
2022-02-11 00:37:54 UTC
File Type:
PE+ (Exe)
Extracted files:
124
AV detection:
32 of 43 (74.42%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
netsupport
Score:
10/10
Tags:
family:netsupport discovery evasion persistence rat trojan upx
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System policy modification
NSIS installer
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Drops startup file
Loads dropped DLL
Windows security modification
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Sets file execution options in registry
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Modifies Windows Defender Real-time Protection settings
Modifies Windows Defender notification settings
NetSupport
Registers COM server for autorun
Unpacked files
SH256 hash:
b6a0cc1e5488c0c9f1429d1744f8c2f81f7dce4229b8322fbdad043cd9084b1f
MD5 hash:
88eb1f48be9f402a57f604c0a9aae82e
SHA1 hash:
b00e619270665c52a6d51ab9cd119aceaa34cd24
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.