MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
SHA3-384 hash: a1162265ea3c89de99b8b58ebdd55e95756a56a68dee7b16cf898556750eeb15c50488009d068183be9beb2db269f780
SHA1 hash: 16efef044636e7bbd6180a9e6d572e1ff013a6a0
MD5 hash: cceca0c502746bb8cc7869434234830d
humanhash: sodium-sierra-artist-oklahoma
File name:file
Download: download sample
Signature NetSupport
Create hunting rule
File size:7'294'073 bytes
First seen:2025-12-31 14:41:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c75a83e117d2bdfb2814c53e840c172 (5 x SalatStealer, 4 x QuasarRAT, 2 x XWorm)
ssdeep 196608:D5v9gsfV/uB307X7Kpds1R2pVhb82BLryJ7mFOKmD:DF9ga/57Kpm1RqVhb82dQVK4
Threatray 1'044 similar samples on MalwareBazaar
TLSH T1A9763318E6B805FDE1B7E179CA968C02F676B8495371E6CF03B069521F236E09F39712
TrID 87.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
5.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.4% (.EXE) Win64 Executable (generic) (10522/11/4)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 9494b494d4aeaeac (904 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter Bitsight
Tags:172-86-117-36 D dropped-by-gcleaner EU.file exe NetSupport


Avatar
Bitsight
url: http://194.38.20.224/service

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.86.117.36:443 https://threatfox.abuse.ch/ioc/1689194/

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Archives NetSupport
Details
Archives
SFX commands and extracted archive contents
BatchScript
varying reportable information from embedded commands and any observed URLs
NetSupport
client configuration settings including a c2 socket address
NetSupport
an updated description describing the component
NetSupport
license configuration settings including a licensee and serial number
Link:
https://research.acce.ciphertechsolutions.com/results/93fa4af7-7c3e-49a4-8873-9b135ef4a0fc/
Malware family:
netsupport
Create hunting rule
ID:
1
File name:
_194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee.exe
Verdict:
Malicious activity
Analysis date:
2025-12-31 14:43:59 UTC
Tags:
netsupport remote rmm-tool auto-reg
Link:
https://app.any.run/tasks/00044fcf-e60e-41d8-96d8-dc19fb5a714a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46668/
Detection(s):
SecuriteInfo.com.W64.Kryptik.GWG.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695536aed2357cccc3de2f44
Tags:
vmdetect netsup
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm anti-vm anti-vm base64 cmd control cscript evasive expired-cert exploit explorer fingerprint fingerprint fingerprint hh installer installer installer-heuristic keylogger lolbin microsoft_visual_cc netsupport netsupportmanager overlay overlay packed remoteadmin sfx unsafe virus wscript zero
Link:
https://www.filescan.io/uploads/695536458d1aa9829e280ec6/reports/e7f6e039-15aa-4acc-881c-d2eac10b363e/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-31T11:50:00Z UTC
Last seen:
2025-12-31T21:03:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.Script.NetSup.gen BSS:Trojan.Win32.Generic BSS:Exploit.Win32.Generic not-a-virus:RemoteAdmin.Win32.NetSup.i not-a-virus:HEUR:RemoteAdmin.Win32.NetSup.gen PDM:Trojan.Win32.Generic Backdoor.RABased.HTTP.C&C RemoteAdmin.NetSup.HTTP.C&C RemoteAdmin.NetSup.UDP.C&C
Link:
https://opentip.kaspersky.com/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee/results?tab=lookup
Malware family:
NetSupport Ltd
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/df5a77a7-a4d8-419f-94ee-b53cf335eec7
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/cceca0c502746bb8cc7869434234830d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee/
Verdict:
Malicious
Threat:
Family.NETSUPPORT
Link:
https://tip.neiki.dev/file/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
Threat name:
Win64.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2025-12-31 14:42:17 UTC
File Type:
PE+ (Exe)
Extracted files:
485
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfghdyluoz5xdmwxzuatpxjguda4rmi7uyxjzolj4s7yacy55hxa._file
Verdict:
malicious
Label(s):
netsupportmanagerrat
Create hunting rule
Similar samples:
194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
NetSupport
2525adc4361bea978a8f6c08e77211eae0bff2130461429d12ae44f75d8054f2
NetSupport
365caf34915aab7f80a45c6dbbac7637605e81100a2944a4957624567029e41c
NetSupport
966437012d3312230a38ec8b025140a6f55932a60b012e5d0fe649c8a6b71b17
NetSupport
b9576867738918a2d065dfa9b78ec9657a2a8a7464d786d836bfdc843d43a812
NetSupport
error
NetSupport
ff2db923f9b0b3d9122b852b36552c881d26e863f0fa078eefca74f2de11ba57
NetSupport
+ 1'034 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery persistence rat
Link:
https://tria.ge/reports/260106-n4l3tsgm5v/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
NetSupport
Netsupport family
Verdict:
Malicious
Tags:
RemoteAccessTool
YARA:
n/a
Link:
https://app.threat.zone/submission/7fd89e0f-58bd-4691-a950-2706de295177
Unpacked files
SH256 hash:
194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee
MD5 hash:
cceca0c502746bb8cc7869434234830d
SHA1 hash:
16efef044636e7bbd6180a9e6d572e1ff013a6a0
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
00f57b9910630a7049df821a39c733ca35763d9b11a58e8c0e52b06066a52643
MD5 hash:
46eacdca48274cc56965e2f11cc63d66
SHA1 hash:
305429533557823d54f1cb1766d080b7249b6d99
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069
MD5 hash:
ecae8b9c820ce255108f6050c26c37a1
SHA1 hash:
42333349841ddcec2b5c073abc0cae651bb03e5f
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
26dbb528c270c812423c3359fc54d13c52d459cc0e8bc9b0d192725eda34e534
MD5 hash:
325b65f171513086438952a152a747c4
SHA1 hash:
a1d1c397902ff15c4929a03d582b09b35aa70fc0
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
MD5 hash:
a0b9388c5f18e27266a31f8c5765b263
SHA1 hash:
906f7e94f841d464d4da144f7c858fa2160e36db
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
MD5 hash:
8d9709ff7d9c83bd376e01912c734f0a
SHA1 hash:
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
MD5 hash:
00587238d16012152c2e951a087f2cc9
SHA1 hash:
c4e27a43075ce993ff6bb033360af386b2fc58ff
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
MD5 hash:
eab603d12705752e3d268d86dff74ed4
SHA1 hash:
01873977c871d3346d795cf7e3888685de9f0b16
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 hash:
0e37fbfa79d349d672456923ec5fbbe3
SHA1 hash:
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
SH256 hash:
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
MD5 hash:
dcde2248d19c778a41aa165866dd52d0
SHA1 hash:
7ec84be84fe23f0b0093b647538737e1f19ebb03
Link:
https://www.unpac.me/results/d0279639-3efe-4eec-9a3a-e201942dddb4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetSupport

Executable exe 194c71e174767b71b2d7cd0137dd26a0c1c8b11fa62e9cb969e4bf800b1de9ee

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/46668/

Comments