Manuel Statik Analiz (LLM Okumali) — NetSupport Manager RAT | Tehdit: YUKSEK
Arquivo Kimligi
| SHA256 | 92748a3d9b11ce9290270f72147a25250d17d37fedb82b9c91e4bffbfc5e069d |
|---|---|
| Arquivo Adi | Order.exe (siparis yemi) |
| Tamanho | 13.412.505 byte (13MB) |
| Pakeleyici | PyInstaller (Python) |
| String Sayisi | 60.778 (cok buyuk) |
Teknik Analiz
PYINSTALLER_RESET_ENVIRONMENT— PyInstaller runtime tespitiTcl_MutexLock,Tcl_MutexUnlock,Tcl_MutexFinalize— NetSupport Manager Tcl/Tk GUI kullanir- 13MB boyut: PyInstaller Python interpreter + NetSupport kütüphaneleri icerir
NetSupportManager RAT Hakkinda
NetSupport Manager, mesru bir uzak masaustu yonetim yazilamidir. Kotu amacli kampanyalarda saldirganlar bu mesgru araci trojanize eder, sahte fatura/siparis yemi ile dagitir ve kurbanin sistemini izinsiz kontrol altina alir. TA800 grubu basta olmak uzere bircok tehdit akoru tarafindan kullanilmistir. C2 adresi runtime sifrelendigi icin string analizinde gorulmez.
IOC
| SHA256 | 92748a3d9b11ce9290270f72147a25250d17d37fedb82b9c91e4bffbfc5e069d |
|---|---|
| Yem | Order.exe (siparis belgesi) |
| Pakeleyici | PyInstaller + Tcl/Tk |
Lista IOC (1 indicadores)
IOC — NetSupportManager
# SHA256
92748a3d9b11ce9290270f72147a25250d17d37fedb82b9c91e4bffbfc5e069d
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 92748a3d9b11ce9290270f72147a25250d17d37fedb82b9c91e4bffbfc5e069d |