MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetSupport
Vendor detections: 10
| SHA256 hash: | fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759 |
|---|---|
| SHA3-384 hash: | 210c6664540ff5f12a58a4807a44dc22da21553bf51a04b58fd21878c1104e31e42406bcf6ab8f5c34079add9915c4f3 |
| SHA1 hash: | c4e68a429f12dfc33c63161d63b127ae5ba10f56 |
| MD5 hash: | 88b39340d29f08a450c42eba59f35646 |
| humanhash: | river-orange-butter-three |
| File name: | fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759 |
| Download: | download sample |
| Signature | NetSupport |
| File size: | 3'603'925 bytes |
| First seen: | 2021-08-05 09:10:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 49152:CeDfnRnAmd9CTHOmz5buZ+E5yJN3NN5c97qC+/0mh/w6kCkCxvRxYcmM7tx9J6cJ:CwvRniTumMl8NdNoe1dp6AccptJhXmi |
| Threatray | 849 similar samples on MalwareBazaar |
| TLSH | T1ABF52202B5A1C572DC2E293C4D771FD4E4366E637B1D6ADB93E330598A321D225F0AA3 |
| dhash icon | 265938f6dcd8c936 (1 x NetSupport) |
| Reporter |  JAMESWT_WT |
| Tags: | coinduck.duckdns.org exe NetSupport |
Intelligence
File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759
Verdict:
Suspicious activity
Analysis date:
2021-08-05 09:12:30 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
DNS request
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Creating a file
Deleting a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Using the Windows Management Instrumentation requests
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Query of malicious DNS domain
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.ChePro
Status:
Malicious
First seen:
2021-06-03 01:50:09 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 46 (54.35%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 839 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Score:
10/10
Tags:
family:netsupport rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
NetSupport
Unpacked files
SH256 hash:
cfd30b3ad1570c7dc766888db6c1e095c6ec0bab62f5f01d62dcd1071a2fb4f7
MD5 hash:
72b7a1b4997bd56f2c3e4c787a943160
SHA1 hash:
27a2abff6b5d2b0c864b52ff398e1fb27fb636de
SH256 hash:
bdcd2ce92e1e14e08ded07960ba73210d8e9cc2a9c3249594cccbafc52158103
MD5 hash:
5882bafc282870141812bd6709bdbdb8
SHA1 hash:
a1be3264acf80ee5f234e73223f09a3117ed0c24
SH256 hash:
bf7a80223df33f6f942774ee2bb510a17f3cc69ac57bc5f6c3ec41d8186106e1
MD5 hash:
d631780dde30af7d14db7952524e443f
SHA1 hash:
f9cea385f6f5c5ddb7f319f1686da414fc47f320
SH256 hash:
2cda14065979f27eface40eeb447295f72d6d58a18eb3e40e5977718ab0e8adc
MD5 hash:
ab51e42f8e1d6c258c6e0d87b00fb47b
SHA1 hash:
94ed556e572865dfd3b8bd8ad9c06f9cfd7fc1cf
SH256 hash:
575a77da4206302ed613e553c531157b6e4ce6945c4609ad7691b7e92eceadc4
MD5 hash:
b141c2d9eb4a8efe5c87a8ffb2b163e1
SHA1 hash:
8032e7fa0ebae9a238e4f59102799105e936a9ce
SH256 hash:
33499c567ae33cee6de42360064d8838a07334d49e8b1b23a4a6e83666b432dc
MD5 hash:
270ef21ac1b315836ec5cdfe45291c07
SHA1 hash:
55d6b2dc58a2feb56f8a690cd674207614275599
SH256 hash:
a8ed8a5158418ad63780cc7f3468f23194a3c8730468f282a5f3fa90185c9026
MD5 hash:
c64ae8a182e730bf1aae4d08421c9e12
SHA1 hash:
4f304153cdd67676f3980238150d3658b1117533
SH256 hash:
d4c4cab24fa564c064a1d922b185f148cc14546db011596b517baf5bc14f14f8
MD5 hash:
244355e34158c1d589816b3cb3dddd44
SHA1 hash:
4412ee42e4fdb5572cb198d753d35c37664c7a26
SH256 hash:
fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759
MD5 hash:
88b39340d29f08a450c42eba59f35646
SHA1 hash:
c4e68a429f12dfc33c63161d63b127ae5ba10f56
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.