MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5
SHA3-384 hash: 8b0711e436f167972fe20dff1d961cfb73f53e21ccdb2133fd5e46fa0bfe37f12082697bd5a857cc521fff28039f0f0f
SHA1 hash: 22762a11bd27f784c313147677b95e0fe876417c
MD5 hash: ba6f091c2076760b2917cfff591194c7
humanhash: kitten-orange-seventeen-sad
File name:20074792_Details.zip
Download: download sample
Signature NetSupport
Create hunting rule
File size:1'046 bytes
First seen:2022-12-28 11:35:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24:DyUgiVV2RHn8GqNjZDvlrsjKs0UiU4Ayy:XVV4H8GqNjZDvlzDSJ
TLSH T18811D88B91121710D0B2C636E77AAE39076474292444485E370E1F758653D61CCB0AC8
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter k3dg3___
Tags:lnk NetSupport powershell zip


Avatar
k3dg3
USPS themed

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:4014_O.lnk
File size:2'392 bytes
SHA256 hash: b954a3d027ddb4ad5d74a46701b887c5c27fe35725f2afae522a9aa833d58a84
MD5 hash: dce4a15e4dd60f761f1c0120882439f4
MIME type:application/octet-stream
Signature NetSupport
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.ICEDOnTHeFringeIsSoDarnFrosty.20220829.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-2.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5/results/dashboard
Payload URLs
URL
File name
http://1otal.com/index/index.php
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/63ac2a24dde391056ac0945a/reports/9ee3b6af-92ca-4257-a059-4590e1dd3316/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5/
Threat name:
Shortcut.Trojan.GenAutorunLnkFile
Create hunting rule
Status:
Malicious
First seen:
2022-12-28 11:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
8 of 39 (20.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6axspjromnvqpowm32smyxoo7tpvlxvl4balxh7slgp3j6oh22q._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/221228-pmq6wsde2t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
NetSupport
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:Long_RelativePath_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_ZIP_LNK_PhishAttachment
Create hunting rule
Author:ignacior
Description:Detects suspicius tiny ZIP files with malicious lnk files
Reference:Internal Research
Rule name:SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious tiny ZIP files with phishing attachment characteristics
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

NetSupport

zip b781793d31731b583dd666f52662ee77e6faaef55f0205dcff92ccfda7ce3eb5

(this sample)

NetSupport

Executable exe e4985a9739637aad4a409c95da33a1304dc17fd6ef9046159b27c0b137a57911

  
Link
https://tria.ge/221228-nhxmfadd2y/behavioral2
  
Dropping
SHA256 e4985a9739637aad4a409c95da33a1304dc17fd6ef9046159b27c0b137a57911
  
Delivery method
Distributed via e-mail link

Comments