Contenido disponible en idioma original
class="post-article">
RAT C++ Activo desde 2017

NetSupportRAT

NetSupportRAT NetSupport Manager abuse. Legitimate remote management tool used maliciously. CurrentVersion\Run persistence.

Perfil de amenaza
Tipo RAT
Lenguaje de programaciónC++
Protocolo C2TCP/HTTP
Primera detección2017
Objetivos Kurumsal
Propósito / Capacidades
  • Remote Access
Aún no se han identificado servidores C2 para esta familia.

Informes de investigación (5)

Orta

NetSupportRAT -- Rate_RATE_AGR_Jun29.exe Tarih Damgalı Anlaşma Lürü, CurrentVersion/Run Autorun, Connection Timeout Retry Meşru NetSupport Stringleri | Orta

NetSupportRAT 196KB Rate_RATE_AGR_Jun29.exe Jun29 tarih damgali rate agreement lurü. Software\Microsoft\Windows\CurrentVersion\Run autorun. Connection timeout after d ms retrying.

Leer informe →
Yüksek

NetSupportRAT2 -- geo.netsupportsoftware.com Konum Servisi, EV_CONFIGSET Olay Protokolü, Ses Akışı PCICL32.DLL | Yüksek

NetSupportRAT2 2.2MB NS2H.zip PCICL32.DLL. geo.netsupportsoftware.com loca.asp konum servisi. EV_CONFIGSET olay protokol. Ses akisi ses izleme.

Leer informe →
Orta

NetSupportRAT -- Rate_RATE_AGR_Jun29.exe Haziran 29 Tarihli Teklif Lure, Kodlanmış Config | Orta

NetSupportRAT 201KB Rate_RATE_AGR_Jun29.exe Haziran 29 teklif anlasma lure. IMCPBLGFEPGLGD uzun kodlanmis config string.

Leer informe →
Yüksek

NetSupportRAT -- Rate_RATE_AGR_Jun29.exe Teslim Adlandırma, Meşru RMM Kötüye Kullanımı | Yüksek

NetSupportRAT 201KB Rate_RATE_AGR_Jun29.exe. Meşru NetSupport Manager RMM aracının tehdit aktörü kötüye kullanımı. TA569.

Leer informe →
Yüksek

NetSupportRAT -- Rate_RATE_AGR_Jun29.exe 201KB, Windows System Settings Host Kamuflaj | Yüksek

NetSupportRAT 201KB. Windows System Settings Host XML kamuflaj. Registry persistence.

Leer informe →