MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401
SHA3-384 hash: 4b7c1e8bfc4062df334e0f9ea6b0e29330d40c6de0833d668387126378b857a30b2f47696afc74b8ec4c67596e53d5fa
SHA1 hash: 85341e1f4bb8a51965a3d6ed8fe56d9a0b043ec4
MD5 hash: e4071e11df741d7fe2e7f4aec1fc572f
humanhash: lake-carpet-diet-uranus
File name:pmpbj_19072022_085737.vbs
Download: download sample
Signature NetSupport
Create hunting rule
File size:20'668 bytes
First seen:2022-07-19 18:17:37 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:xFcE38pJdCZNRhsfqTpj/zjHuG+oY05Ad/iII5sltlw:hLqBjljw
Threatray 77 similar samples on MalwareBazaar
TLSH T1D4928C6D034FA4E89773ACC88AD5AC57FB7486264A2CCAC89F70FEFA2410174A0F551D
Reporter abuse_ch
Tags:NetSupport vbs


Avatar
abuse_ch
Payload URL:
https://a2p2pulsepower.org/wp-content/plugins/index.html

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291973/
Detection(s):
SecuriteInfo.com.ISB.Downloadergen80.621.23767.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1036793
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Delayed program exit found
Encrypted powershell cmdline option found
Multi AV Scanner detection for dropped file
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 669289 Sample: pmpbj_19072022_085737.vbs Startdate: 19/07/2022 Architecture: WINDOWS Score: 100 45 Antivirus detection for URL or domain 2->45 47 Yara detected Powershell download and execute 2->47 49 Uses known network protocols on non-standard ports 2->49 8 wscript.exe 1 2->8         started        11 presentationhost.exe 2->11         started        13 presentationhost.exe 2->13         started        process3 signatures4 53 VBScript performs obfuscated calls to suspicious functions 8->53 55 Wscript starts Powershell (via cmd or directly) 8->55 57 PowerShell case anomaly found 8->57 15 cmd.exe 1 8->15         started        process5 signatures6 63 Suspicious powershell command line found 15->63 65 Wscript starts Powershell (via cmd or directly) 15->65 67 Encrypted powershell cmdline option found 15->67 69 2 other signatures 15->69 18 powershell.exe 15 33 15->18         started        23 conhost.exe 15->23         started        process7 dnsIp8 37 a2p2pulsepower.org 85.234.143.107, 443, 49753 SIMPLYTRANSITGB United Kingdom 18->37 29 C:\Users\user\AppData\...\remcmdstub.exe, PE32 18->29 dropped 31 C:\Users\user\...\presentationhost.exe, PE32 18->31 dropped 33 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 18->33 dropped 35 6 other malicious files 18->35 dropped 51 Powershell drops PE file 18->51 25 presentationhost.exe 18->25         started        file9 signatures10 process11 dnsIp12 39 pinustamilbe10.com 151.236.14.69, 2940, 49784 NFORCENL European Union 25->39 41 geography.netsupportsoftware.com 62.172.138.35, 49789, 80 BTGB United Kingdom 25->41 43 geo.netsupportsoftware.com 25->43 59 Multi AV Scanner detection for dropped file 25->59 61 Delayed program exit found 25->61 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=epc72z4makscggnxltqmt23mp2g2eyfp6254mwgyxrj7e2gaqqaq._file
Verdict:
unknown
Similar samples:
3d47aa3f5d36514cf264d75f75774318f4a00f8258c73f61631f995613f7290d
NetSupport
61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2
NetSupport
996004853edac15918294b18cc8f7145b2e4f230f83fc90314c8253a9eb3772f
NetSupport
a60f3cfa331d387f6c6f704f97320d7743d28fa3499eae89422bba890036e2a1
NetSupport
ca59f322967c867315d4f05cddcaccb771295b499477467e4e5da4978f94d94c
NetSupport
f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783
NetSupport
+ 67 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/220719-wxlgqafhe7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
NetSupport
Malware Config
Dropper Extraction:
https://a2p2pulsepower.org/wp-content/plugins/index.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/2259060/
Cape
Cape
https://www.capesandbox.com/analysis/291973/

Comments