MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 13


Intelligence 13 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d
SHA3-384 hash: 9e2b68cf660706f8d5a25c3dfd5357d0e1f6a0f71c6bede136d1b879e1c1612bdf7c2270529546bf6f09f83c35265524
SHA1 hash: 9c6e729aae107106222fdb90658f8924e38a055d
MD5 hash: 74e6c43964c65897fb5207c0106beecf
humanhash: mountain-timing-october-lima
File name:RateConfirmation9613.exe
Download: download sample
Signature NetSupport
Create hunting rule
File size:146'200 bytes
First seen:2026-04-16 13:35:08 UTC
Last seen:2026-04-16 22:01:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 22f72afad7d0f4d7e319f83ffd38352e (1 x NetSupport)
ssdeep 3072:FLrquSFw9QaheybbpY72r0QwMedkDM/bUtZCVXBBXE2V3sTg:FvquoqQjr2r0hMedwwYtZf2Vgg
TLSH T109E38E65B4C0C0B2D8B569301570DBB2AA7DF9700F649DDB338856B95F207C0EB399AB
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter SquiblydooBlog
Tags:91-202-233-25 exe NetSupport signed

Code Signing Certificate

Organisation:ANTHONY PERKINS
Issuer:Microsoft ID Verified CS EOC CA 04
Algorithm:sha384WithRSAEncryption
Valid from:2026-04-14T21:41:02Z
Valid to:2026-04-17T21:41:02Z
Serial number: 33000056b4bbea79f1da04e1350000000056b4
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: be646dce1a901b4968b1daa258d1b4e1e3b62e1b2a51ad8557434e08288a2dcc
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
140
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
netsupport
Create hunting rule
ID:
1
File name:
_2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d.exe
Verdict:
Malicious activity
Analysis date:
2026-04-16 13:37:46 UTC
Tags:
netsupport rmm-tool auto-startup auto rat tool
Link:
https://app.any.run/tasks/d94831d4-f4b7-4b7f-bf89-679fce855c9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61869/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69e0e5b5f68adfe1003a66bc
Tags:
vmdetect autorun netsup
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug cmd lolbin microsoft_visual_cc short-lived-cert signed
Link:
https://www.filescan.io/uploads/69e0e5ac799d5bf3250272f8/reports/4f837bdf-6652-4393-9ec3-d844bd020416/overview
Verdict:
Suspicious
Labled as:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-16T03:52:00Z UTC
Last seen:
2026-04-17T18:33:00Z UTC
Hits:
~100
Detections:
Trojan-Banker.Win32.ChePro.nlnc Trojan-Banker.ChePro.HTTP.ServerRequest Backdoor.RABased.HTTP.C&C RemoteAdmin.NetSup.UDP.C&C RemoteAdmin.NetSup.HTTP.C&C NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C
Link:
https://opentip.kaspersky.com/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/606663cc-639a-4f29-8a35-5f418aebdb7c
Score:
59%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/74e6c43964c65897fb5207c0106beecf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d/
Verdict:
Malicious
Threat:
Family.NETSUPPORT
Link:
https://tip.neiki.dev/file/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d
Threat name:
Win32.Worm.AutoRun
Create hunting rule
Status:
Malicious
First seen:
2026-04-16 07:49:58 UTC
File Type:
PE (Exe)
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eoj7oun7rjq5nriul2ynbyxjar4x6yzrizdzczixbv6puoyv6y6q._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport adware discovery execution rat spyware
Link:
https://tria.ge/reports/260416-qv17hagy7r/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Drops startup file
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Family: NetSupport
Malware Config
Dropper Extraction:
https://gofasterthanever.com
https://gofasterthanever.com/gate.php?key=KeyGo77245&vid=67386b7271746e317963396d6f786a36&action=started
https://gofasterthanever.com/update12.zip
https://gofasterthanever.com/gate.php?key=KeyGo77245&vid=67386b7271746e317963396d6f786a36&action=failed
Unpacked files
SH256 hash:
2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d
MD5 hash:
74e6c43964c65897fb5207c0106beecf
SHA1 hash:
9c6e729aae107106222fdb90658f8924e38a055d
Link:
https://www.unpac.me/results/6873b4e1-fb08-499f-9662-7a2599f841c3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2393f751bf8a61d6c5145eb0d0e2e904797f633146479165170d7cfa3b15f63d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61869/

Comments