MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535
SHA3-384 hash: cc2b12ae4f5a33d5995bde01c6345fd487f3eeea04f0d81f0ba6e8eb4dea0f7ecc55a557cbebf6b30503717f279673ee
SHA1 hash: 32cfbc76c92ee4a16bf655c4fde8dd57db99dce7
MD5 hash: f82b3b47fa880c8b3e0b54e30e981c7a
humanhash: pip-pasta-triple-august
File name:INV_3brj41ut.rlf.js
Download: download sample
Signature NetSupport
Create hunting rule
File size:46'690 bytes
First seen:2023-04-13 06:15:50 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:iZzSOIAV9i1AE3fp2S4XPsx7JSAdPrI1BWF6S0QEwPMwc3d:48AS4XPyoQPk1kF9Ad
TLSH T1BB233F8C33E7A0720733F2AD925A9C51E26A593791A41407FC4CE055FFF252DD6A0ABB
Reporter abuse_ch
Tags:js NetSupport


Avatar
abuse_ch
NetSupport payload URLs:
https://yousefjameh.com/new/sets.ps1
https://eylulsifalitas.com/baot.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
360
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.HEUR.Trojan-Downloader.Script.SLoad.gen.13659.4273.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/64379e24df3b1ce1592eed5f/reports/e1fba9e2-473e-4e15-9bf2-295bcf9f081b/overview
Verdict:
Suspicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535
Result
Verdict:
UNKNOWN
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
rans.bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1213041
Signature
Bypasses PowerShell execution policy
Contains functionality to modify clipboard data
Encrypted powershell cmdline option found
Found potential ransomware demand text
JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Malicious encrypted Powershell command line found
Multi AV Scanner detection for dropped file
Potential dropper URLs found in powershell memory
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Powershell drops NetSupport RAT client
Snort IDS alert for network traffic
Suspicious powershell command line found
Uses known network protocols on non-standard ports
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 845957 Sample: INV_3brj41ut.rlf.js Startdate: 13/04/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Sigma detected: Powershell drops NetSupport RAT client 2->47 49 Yara detected Powershell download and execute 2->49 51 5 other signatures 2->51 8 wscript.exe 1 2->8         started        11 client32.exe 2->11         started        13 client32.exe 2->13         started        process3 signatures4 55 Malicious encrypted Powershell command line found 8->55 57 JScript performs obfuscated calls to suspicious functions 8->57 59 Wscript starts Powershell (via cmd or directly) 8->59 61 PowerShell case anomaly found 8->61 15 cmd.exe 1 8->15         started        process5 signatures6 67 Malicious encrypted Powershell command line found 15->67 69 Suspicious powershell command line found 15->69 71 Wscript starts Powershell (via cmd or directly) 15->71 73 3 other signatures 15->73 18 powershell.exe 15 51 15->18         started        23 conhost.exe 15->23         started        process7 dnsIp8 37 yousefjameh.com 185.67.101.216, 443, 49696 LASER-IDCIR Iran (ISLAMIC Republic Of) 18->37 29 C:\Users\user\AppData\...\remcmdstub.exe, PE32 18->29 dropped 31 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 18->31 dropped 33 C:\Users\user\AppData\...\client32.exe, PE32 18->33 dropped 35 7 other files (6 malicious) 18->35 dropped 53 Powershell drops PE file 18->53 25 client32.exe 18 18->25         started        file9 signatures10 process11 dnsIp12 39 balbalz1.com 79.137.207.54, 49699, 5222 PSKSET-ASRU Russian Federation 25->39 41 geography.netsupportsoftware.com 62.172.138.67, 49701, 80 BTGB United Kingdom 25->41 43 geo.netsupportsoftware.com 25->43 63 Multi AV Scanner detection for dropped file 25->63 65 Contains functionality to modify clipboard data 25->65 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7neioxn3bjfx5gwyshrfnb5l7jdpwdnzlw4qxujv65qy6yxyu2q._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/230413-g1fy3sbb6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
NetSupport
Malware Config
Dropper Extraction:
https://yousefjameh.com/new/sets.ps1
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/37da443aedd8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetSupport

Java Script (JS) js 37da443aedd8525bf4d6c48f12b43d5fd237d86dcaedc85e89afbb0c7b17c535

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/host/eylulsifalitas.com/
  
Delivery method
Distributed via e-mail attachment

Comments