MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f
SHA3-384 hash: 8bbe71bf03b39724ab737e682c8c85ae6e923cc41a36581aa6e4b4d2d1f9ebb029f86e23fcd39a93572699b1dac2fd84
SHA1 hash: b6fffdeb2df0789cef2201416894f5ca6e055bfc
MD5 hash: e52be8968152e665685d030c8d641540
humanhash: carbon-nine-winner-carolina
File name:E52BE8968152E665685D030C8D641540.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:2'083'802 bytes
First seen:2024-02-08 07:50:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 986447145f752ee174944cbcb0f6260b (2 x NetSupport)
ssdeep 49152:mXeTIVDZ5quXQqyAZF8L5wfHIvDVeoyS69XZJJdxopHq:mXe0RZlXQq5ZeLW/KynLJdypHq
TLSH T1C6A5333231C2C432D937A43949D8A3319875BD26A6B9D44FBB911E7CAF72F80EB15742
TrID 76.2% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
8.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon cdabae6fe6e7eaec (20 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter abuse_ch
Tags:DcnLaleanae8-com DcnLaleanae9-com exe NetSupport


Avatar
abuse_ch
NetSupport C2:
45.11.180.127:3120

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
netsupport
Create hunting rule
ID:
1
File name:
ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f.zip
Verdict:
Malicious activity
Analysis date:
2024-02-09 00:21:10 UTC
Tags:
netsupport remote unwanted
Link:
https://app.any.run/tasks/f4a8443d-84fa-46ad-b653-042659e75eea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/475334/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm anti-vm cmd control cscript evasive explorer fingerprint hook installer keylogger lolbin lolbin netsupport overlay packed packed remote remoteadmin sfx shdocvw shell32 wscript
Link:
https://www.filescan.io/uploads/65c487f0186112aa12a3af04/reports/d39b27f8-656f-4dc9-8a31-aa4b64e2a571/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetSupport Ltd
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/82ab1420-331b-467a-99b8-1f7c4aa49dc2
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1388894
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Delayed program exit found
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Score:
72%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f/
Threat name:
Win32.Trojan.Netsupportmanager
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 09:27:15 UTC
File Type:
PE (Exe)
Extracted files:
466
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5i2xs6uvkzrwg6adczc2jdyiscd42jmprzaocom2uny3ftfdzn7q._file
Verdict:
malicious
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport rat
Link:
https://tria.ge/reports/240208-jptrxadb52/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
NetSupport
Unpacked files
SH256 hash:
fe0632e4e8b26978027ceadb735d3e50870715cf0085ece4e20c0d9954f994c0
MD5 hash:
603854ec12298ddf62308959e932cefa
SHA1 hash:
9ca96ec76cf31301f0f45a7e872ecf31f34254b4
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2
MD5 hash:
5be6fb8f28544d4f83c25a2b76ff7890
SHA1 hash:
6ad5d9338984c52b37f2176c8ae4ae2366a7fd25
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 hash:
0e37fbfa79d349d672456923ec5fbbe3
SHA1 hash:
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
MD5 hash:
67c53a770390e8c038060a1921c20da9
SHA1 hash:
49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
MD5 hash:
7629af8099b76f85d37b3802041503ee
SHA1 hash:
f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
00f57b9910630a7049df821a39c733ca35763d9b11a58e8c0e52b06066a52643
MD5 hash:
46eacdca48274cc56965e2f11cc63d66
SHA1 hash:
305429533557823d54f1cb1766d080b7249b6d99
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
368233ba97a1bd7a4f6f5ee0233943efb79af45a4c57e64b1250cb3f6afd7620
MD5 hash:
d033d1a50e461266003680f4057852f6
SHA1 hash:
d654f28ae96cbdd85cf99953061f40ee4ddec3b8
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
52b3b0def2a52a0f5e14472aa7bdddb50ba20233635390261383f8550bca30f7
MD5 hash:
dcdcaeed003ceea76c2edf44837715b7
SHA1 hash:
78966b4d268c81dc070d2b7986bf50460e75986b
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
287b0aafc7e45264720a891ef9dedd9d19eadc072937b655b19790f87ac17afb
MD5 hash:
a8af8917cada159b768d8b255ad56cd4
SHA1 hash:
51bdd719ea513b5e6662245107efe8303b222613
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
SH256 hash:
ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f
MD5 hash:
e52be8968152e665685d030c8d641540
SHA1 hash:
b6fffdeb2df0789cef2201416894f5ca6e055bfc
Link:
https://www.unpac.me/results/02b45800-9bf1-4b9f-8cef-6d0cc9ec8c37/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/475334/

Comments