MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2373c3f0f5a59be2a6b3780a2878ee464c2069e38935f5a1607ae115929683aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2373c3f0f5a59be2a6b3780a2878ee464c2069e38935f5a1607ae115929683aa
SHA3-384 hash:	0ccbb80ee42d2289604a96deb88b0ff54c0c208fd520d2429a71fe5a75065ee85f10fc5fbb919122c8c6f426b9a395da
SHA1 hash:	5ec32e5a66f5810ab2e558e72a6991a7c1175474
MD5 hash:	dbde5a9e9cdef8f105e27eabab0d6e05
humanhash:	florida-november-autumn-seventeen
File name:	rechnung2649052_1594527_pdf.4970223.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	30'561 bytes
First seen:	2023-05-12 13:38:45 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:MHjOgB54f2zAYKjQZ5o0g/bj6qe13lFErochuNqwECqI8W6jmZu+6J5N:6j+6rT5Lmm0L8Nv4WaVl
TLSH	T155D2DFD826E3B012875BF07D776FACD1E22448574BC56A0BB80C7254FF99C2CCAA4769
Reporter	Anonymous
Tags:	js NetSupport

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

337

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/645e417796ddf417201091e2/reports/5e90116e-8f39-45b9-b57c-dc5b74dd3ade/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2373c3f0f5a59be2a6b3780a2878ee464c2069e38935f5a1607ae115929683aa

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox NetSupport RAT

Result

Threat name:

NetSupport RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1231641

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Powershell drops PE file

Sigma detected: Powershell drops NetSupport RAT client

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Very long command line found

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2373c3f0f5a59be2a6b3780a2878ee464c2069e38935f5a1607ae115929683aa/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=enz4h4hvuwn6fjvtpafcq6hoizgca2pdre27lilaplqrleuwqova._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport persistence rat

Link:

https://tria.ge/reports/230512-qxyjdsfe2z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

NetSupport

Malware Config

Dropper Extraction:

http://193.233.232.150/file3.ps1
https://stackapk.com/pages/apostrk.php

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2373c3f0f5a5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.