MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8
SHA3-384 hash:	c8f7d5dbfcdb83cdc736354c91fb2f0757e7d460c52a7397414c66afea48ed344dbf1bc127eaf0b31e14b73088289d18
SHA1 hash:	3b8f7ae6b0282be88d08b171bf9267fdf4cbf28e
MD5 hash:	975b043ed876f1c265aacb60bbea6b11
humanhash:	tennessee-triple-king-march
File name:	22.bat
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	532 bytes
First seen:	2023-08-02 08:20:46 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12:kh5ObfauP28nlxWZ3lMVj0ESLXRtf4LXnidEWSDcEA:B62AlMVJuXRtf8XnIED2
TLSH	T1B6F0C9103E93079FB82282B0830AC4B2EB63CF4F31C11A66ECD8661AC041B41F06E1C6
Reporter	JAMESWT
Tags:	94-158-247-23 bat NetSupport

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

101

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

22.bat

Verdict:

Suspicious activity

Analysis date:

2023-08-02 08:22:01 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5d39d4a1-4e49-4e9f-bef5-597b0f727a8c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/439758/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Running batch commands

Creating a file

Searching for the window

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

cmd timeout

Link:

https://www.filescan.io/uploads/64ca11f088dd49b8cef6e70c/reports/a2c254dd-80d7-454c-bbb0-13842efbdcb3/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

n/a

Score:

22 / 100

Link:

https://www.joesandbox.com/analysis/1284214

Signature

Uses cmd line tools excessively to alter registry or file data

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ncccg3pm7yk4plckzsikjwg5gdozdspge3h7il2xfr546el23ma._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

persistence

Link:

https://tria.ge/reports/230802-j8zr9sdf32/

Behaviour

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI NetSupportManager RAT

Threat name:

NetSupportManager RAT

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetSupport

bat f344211b6f67f0ae3d6256648526c6e986ec8e4f31367fa17ab963de788bd6d8

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2695810/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/439758/