MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59
SHA3-384 hash:	b11030c50925f4d1c57a5116c12084c95f787eabb4a873a89a4d239b91d1a828405a7c0db4e839bd53a2acbe9d120eee
SHA1 hash:	c3245fd8e474f699fad9ad5ad2561b0e2d551a62
MD5 hash:	65cbd03ac62f30146ea564cefc780a4f
humanhash:	harry-butter-tennessee-hotel
File name:	98181772.zip
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	7'947 bytes
First seen:	2023-01-19 18:22:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:2QEk9DpRYBuAzt13q9+bvEjuPoAdQ5hdoG4cQIZd:f93OuAJ138+8uzdQvdHZd
TLSH	T166F1A04EF697CA20CFF080F858E46462833BA905AD7D634F54E4402C967637C15D9DD6
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	malware_traffic
Tags:	NetSupport RAT zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

114

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	2326.js
File size:	29'062 bytes
SHA256 hash:	b1f52abc28427c5a42a70db9a77163dde648348e715f59e8a335c7252ae4a032
MD5 hash:	72dc8b8b6c7c083128728b8405fa5a8f
MIME type:	text/plain
Signature	NetSupport

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

75%

Tags:

evasive obfuscated sload

Link:

https://www.filescan.io/uploads/63c98a51447edb203affd185/reports/10e320b0-5aac-4c20-b222-97b616875cdd/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59/

ReversingLabs TitaniumCloud Archive-ZIP.PUA.Generic

Threat name:

Archive-ZIP.PUA.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-01-19 18:23:08 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 39 (15.38%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xz5tnhwxvkpnjfbxg223qqtxwaapher2k6knlftctxvt4qlqdvmq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport persistence rat

Link:

https://tria.ge/reports/230119-xytp6aea5x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Executes dropped EXE

NetSupport

Malware Config

Dropper Extraction:

http://1otal.com/index/index.php

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be7b369ed7aa9ed4943736b5b84277b000f3923a5794d596629deb3e41701d59