MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11
SHA3-384 hash: 9bc44334d32d31e1a5dbc5db22ce69c8a079c7dd8ba4fda12dbcbe46664acf1dbd1fd56269f4cfeedfa0d53610f156be
SHA1 hash: 5671539e582d08c0c589ba4ac1721af4ed6f71a4
MD5 hash: dbbdc92ca62d36dceef0883b2da867ed
humanhash: don-eight-butter-lion
File name:img499113656.js
Download: download sample
Signature NetSupport
Create hunting rule
File size:62'554 bytes
First seen:2023-05-25 15:19:55 UTC
Last seen:2023-05-25 15:26:31 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:P+UeULOhtYgty9w9CHwYjQiJsnnlrD9a5Ybgu1zD+SpJGgflJcCB1vnJrm6YkFf5:/eUL2tVWWCv07nlPMSgSzyS9tJvM/2
TLSH T1D15382C5BA96F0EA110330B75E174161C7A76DB462CC4A58E074BCA0FD3CE9CE79AB12
Reporter abuse_ch
Tags:js NetSupport

Intelligence

File Origin
# of uploads :
2
# of downloads :
281
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Trojan.Cryxos.12712.15785.19900.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated powershell
Link:
https://www.filescan.io/uploads/646f7caa835dc3f6e4a78daf/reports/5e7498e6-976f-4369-8a3e-cdccc9c9008a/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11
Result
Verdict:
MALICIOUS
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1242580
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)
JavaScript source code contains functionality to generate code involving a shell, file or stream
JavaScript source code contains functionality to generate code involving HTTP requests or file downloads
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for dropped file
Powershell drops PE file
Sigma detected: Powershell drops NetSupport RAT client
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 875588 Sample: img499113656.js Startdate: 25/05/2023 Architecture: WINDOWS Score: 100 50 Snort IDS alert for network traffic 2->50 52 Antivirus detection for URL or domain 2->52 54 Sigma detected: Powershell drops NetSupport RAT client 2->54 56 4 other signatures 2->56 8 wscript.exe 14 2->8         started        12 client32.exe 2->12         started        14 client32.exe 2->14         started        process3 dnsIp4 36 servisaludocupacional.pe 161.132.46.20, 443, 49699 RedCientificaPeruanaPE Peru 8->36 58 System process connects to network (likely due to code injection or exploit) 8->58 60 JScript performs obfuscated calls to suspicious functions 8->60 62 Wscript starts Powershell (via cmd or directly) 8->62 64 3 other signatures 8->64 16 powershell.exe 13 8->16         started        signatures5 process6 signatures7 44 Very long command line found 16->44 46 Encrypted powershell cmdline option found 16->46 48 Powershell drops PE file 16->48 19 powershell.exe 1 53 16->19         started        22 conhost.exe 16->22         started        process8 file9 28 C:\Users\user\AppData\...\remcmdstub.exe, PE32 19->28 dropped 30 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 19->30 dropped 32 C:\Users\user\AppData\...\client32.exe, PE32 19->32 dropped 34 7 other files (6 malicious) 19->34 dropped 24 client32.exe 17 19->24         started        process10 dnsIp11 38 blahadfurtik.com 91.215.85.180, 49702, 5222 PINDC-ASRU Russian Federation 24->38 40 geography.netsupportsoftware.com 62.172.138.67, 49703, 80 BTGB United Kingdom 24->40 42 geo.netsupportsoftware.com 24->42 66 Multi AV Scanner detection for dropped file 24->66 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2023-05-25 15:20:10 UTC
File Type:
Text (JavaScript)
AV detection:
3 of 36 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hricxniccm4o6n3yytowzjb7tl5b7pnclyhrhjozkzec5luavqiq._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/230525-sqr45sbe6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
NetSupport
Malware Config
Dropper Extraction:
https://figocoin.it/auth.php
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3c502bb50213/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetSupport

Java Script (JS) js 3c502bb5021338ef3778c4dd6ca43f9afa1fbda25e0f13a5d956482eae80ac11

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments