🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0
SHA3-384 hash: 646c7cabc97655fe53d32d63245a9f7239b8a9661755a4df52c1aa94b21d4b7ef6ca69ab6c116c71e3f7882dc8daba33
SHA1 hash: 9c9fc660da68775629ab48bb82dd4775b153597a
MD5 hash: bcfd6a7b699f9ff643d346a958ca04a9
humanhash: spaghetti-carpet-freddie-stairway
File name:4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0
Download: download sample
Signature NetSupport
Create hunting rule
File size:2'030 bytes
First seen:2026-06-03 06:45:11 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 24:8SYe9NcrGFjc6aKKILhWhWAsuWkp+/CWP2+/C46DwW8loxO4I0WROkOFpK6+/CIz:8StNcqUbsmHn8lSIL3ABcatdMq4z
Threatray 1'329 similar samples on MalwareBazaar
TLSH T15A41A11617E50715D7F78A3A9CF7F3128635B915ED624FEE024092881CA4128E875F6F
Magika lnk
Reporter JAMESWT_WT
Tags:djkmgndkjfgndfg-com iisexpness-com lnk NetSupport printerdrvrs-com skadfjsdijfhsfso9to-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
LNK
Details
LNK
a command line and any observed urls
Link:
https://research.acce.ciphertechsolutions.com/results/f3d3ae71-3194-463b-8ea8-d02b71a08311/
Detection(s):
Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30517.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30537.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a1eb9a257b7bf261d604381
Tags:
shell virus sage
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade powershell
Link:
https://www.filescan.io/uploads/6a1fcd9312da0d249c6234e6/reports/f21962af-6be0-497c-951c-c5b4027b4b98/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/LNK.NetLoader
Link:
https://www.hybrid-analysis.com/sample/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0
Verdict:
Malicious
File Type:
lnk
First seen:
2026-06-03T12:40:00Z UTC
Last seen:
2026-06-04T20:17:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.WinLNK.Agent.gen
Link:
https://opentip.kaspersky.com/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0
Threat name:
Win32.Trojan.WinLnk
Create hunting rule
Status:
Malicious
First seen:
2026-05-30 22:47:51 UTC
File Type:
Binary
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmwogi7t534jfv75y2ujignsle5xkv5h5cdt7imw63qbmsfkm7aa._file
Verdict:
malicious
Label(s):
netsupportmanagerrat
Create hunting rule
Similar samples:
1c46675149b0f4d926783c855e860b20548568849cdec941a62abb72534d1e68
NetSupport
3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1
NetSupport
47cae3c0b59f0e6a33e7aed184fafd9b978b049a00a88ce1e93ec1ef538fff67
NetSupport
4c2ad96913b0de2746c7cb2257fed000cf9326673d204adb71aa00f7037e936f
NetSupport
7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023
NetSupport
c402d596da833821d27a1d75cca1679455cac65ed3b94ce3e28d155b6c71b5e5
NetSupport
+ 1'319 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/260603-hjce1aav5v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Badlisted process makes network request
Malware family:
NetSupport
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4b2ce323f3ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b2ce323f3eef892d7fdc6a89419b2593b7557a7e8873fa196f6e01648aa67c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious
Rule name:SUSP_LNK_SuspiciousCommands
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects LNK file with suspicious content

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments