MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23ec97b573fa3a2ff88e5689622b8b3b5406e09e77861c50665fd01067e2717e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23ec97b573fa3a2ff88e5689622b8b3b5406e09e77861c50665fd01067e2717e
SHA3-384 hash: 353d679d1cde0e9d5eb806aeceb16284815e7ec30f0ff82d1a7b2008696f452b9507a8790102fcb2b0a0b9368ae0f70b
SHA1 hash: f2861ba5f2f6562f196b1759cc9897cc2596a805
MD5 hash: a2cdebdddfc66011908836ba2f5e2ed3
humanhash: kilo-friend-monkey-kitten
File name:4556QdxEcRRwaanOcwMUbPLadtPY.ps1
Download: download sample
Signature NetSupport
Create hunting rule
File size:3'353 bytes
First seen:2023-04-19 15:33:24 UTC
Last seen:2023-04-19 16:09:16 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 96:jkvHsW+0dyAmuDbgut/+cc0NVGwsA9LlaJFb:jk/w0JBt/b3Ncw7e9
Threatray 196 similar samples on MalwareBazaar
TLSH T1A0616D78E6B5ADC407F672C09ED13445B0746D23D6314678FA8E4CE768B8B05EF346A4
Reporter 0xToxin
Tags:104-156-149-33 balbalz1-com balbalz2-com NetSupport opendir ps1

Intelligence

File Origin
# of uploads :
6
# of downloads :
129
Origin country :
IL IL
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/644009f1c1735fe5e756992c/reports/cd173576-0a04-489b-aaec-07244f669b56/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/23ec97b573fa3a2ff88e5689622b8b3b5406e09e77861c50665fd01067e2717e
Result
Verdict:
UNKNOWN
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1217489
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Delayed program exit found
Encrypted powershell cmdline option found
Found potential ransomware demand text
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sigma detected: Powershell drops NetSupport RAT client
Uses known network protocols on non-standard ports
Very long command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 850431 Sample: 4556QdxEcRRwaanOcwMUbPLadtPY.ps1 Startdate: 20/04/2023 Architecture: WINDOWS Score: 100 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus detection for URL or domain 2->39 41 Sigma detected: Powershell drops NetSupport RAT client 2->41 43 3 other signatures 2->43 7 powershell.exe 11 2->7         started        10 client32.exe 2->10         started        12 client32.exe 2->12         started        process3 signatures4 49 Very long command line found 7->49 51 Encrypted powershell cmdline option found 7->51 53 Bypasses PowerShell execution policy 7->53 55 Powershell drops PE file 7->55 14 powershell.exe 1 51 7->14         started        17 conhost.exe 7->17         started        process5 file6 23 C:\Users\user\AppData\...\remcmdstub.exe, PE32 14->23 dropped 25 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 14->25 dropped 27 C:\Users\user\AppData\...\client32.exe, PE32 14->27 dropped 29 7 other files (6 malicious) 14->29 dropped 19 client32.exe 18 14->19         started        process7 dnsIp8 31 balbalz1.com 79.137.207.54, 49699, 5222 PSKSET-ASRU Russian Federation 19->31 33 geography.netsupportsoftware.com 51.142.119.24, 49700, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United Kingdom 19->33 35 geo.netsupportsoftware.com 19->35 45 Multi AV Scanner detection for dropped file 19->45 47 Delayed program exit found 19->47 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23ec97b573fa3a2ff88e5689622b8b3b5406e09e77861c50665fd01067e2717e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=epwjpnlt7i5c76eok2ewek4lhnkanye6o6dbyudgl7ibaz7cof7a._file
Verdict:
malicious
Similar samples:
1b23f6605bf3ee638b369bc344cbd02591b5a9ab320a874b07088652b8d93888
NetSupport
28fb68d0fc8e305257af9613cf9cfeeb65d12379a7672541f7b3add0a58562a8
NetSupport
4689feea371ab0b27c3b7760ad99d3d587e770b36403fcaf795e4a5c17bef173
NetSupport
a6b33cbfee592d34c4773d04ff1d3a06bc99d192db31bd1074a81ce25bdd049e
NetSupport
c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f
NetSupport
c9d2a196a3a7209755613e769531990104393b8e96971aa1d757e3ab84696f8b
NetSupport
db001e5eed23e82bc4bdd96f95d6db26e8209a087a6a09ea5434346b3d7e7856
NetSupport
fb76386ce3f17a25d59046a70cc05898bcccc7422ab92681777071e46d8943e5
NetSupport
+ 186 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/230419-szsf9sbd76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetSupport
Malware Config
Dropper Extraction:
https://medpau.net/323421.zip
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/23ec97b573fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/23ec97b573fa3a2ff88e5689622b8b3b5406e09e77861c50665fd01067e2717e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments