MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5109678b00c6140a7f3183450dd0020be13d38f4ed8adcc820c2c12aa1d66ac3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5109678b00c6140a7f3183450dd0020be13d38f4ed8adcc820c2c12aa1d66ac3
SHA3-384 hash: 6558e7551abdeba8aaff4b34125b241f2e24325ab36a21edb0ac5447ae9b4c235a6d11d5c2741256c5f33fc7eb4a8390
SHA1 hash: c25013201f20007f489115b9722a2c8548a9e68e
MD5 hash: 18f0a0d80fbdf34e00fb19ecebdc5326
humanhash: juliet-helium-india-sweet
File name:b4_19072022_092936.vbs
Download: download sample
Signature NetSupport
Create hunting rule
File size:20'769 bytes
First seen:2022-07-19 18:17:39 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:xFcE38pJdCZNRhsfqTpj/zjHuG+oY05Ad/iII5sltln:hLqBjljn
Threatray 82 similar samples on MalwareBazaar
TLSH T109928C6D034FA4E89773ACC88AD5AC57FB7486264A2CCAC89F70FEFA2410174A0F551D
Reporter abuse_ch
Tags:NetSupport vbs


Avatar
abuse_ch
Payload URL:
https://a2p2pulsepower.org/wp-content/plugins/index.html

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291976/
Detection(s):
SecuriteInfo.com.ISB.Downloadergen80.26225.14565.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1036792
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Multi AV Scanner detection for dropped file
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 669288 Sample: b4_19072022_092936.vbs Startdate: 19/07/2022 Architecture: WINDOWS Score: 100 45 Antivirus detection for URL or domain 2->45 47 Yara detected Powershell download and execute 2->47 49 Uses known network protocols on non-standard ports 2->49 8 wscript.exe 1 2->8         started        11 presentationhost.exe 2->11         started        13 presentationhost.exe 2->13         started        process3 signatures4 53 VBScript performs obfuscated calls to suspicious functions 8->53 55 Wscript starts Powershell (via cmd or directly) 8->55 57 PowerShell case anomaly found 8->57 15 cmd.exe 1 8->15         started        process5 signatures6 61 Suspicious powershell command line found 15->61 63 Wscript starts Powershell (via cmd or directly) 15->63 65 Encrypted powershell cmdline option found 15->65 67 2 other signatures 15->67 18 powershell.exe 15 32 15->18         started        23 conhost.exe 15->23         started        process7 dnsIp8 37 a2p2pulsepower.org 85.234.143.107, 443, 49762 SIMPLYTRANSITGB United Kingdom 18->37 29 C:\Users\user\AppData\...\remcmdstub.exe, PE32 18->29 dropped 31 C:\Users\user\...\presentationhost.exe, PE32 18->31 dropped 33 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 18->33 dropped 35 6 other malicious files 18->35 dropped 51 Powershell drops PE file 18->51 25 presentationhost.exe 18->25         started        file9 signatures10 process11 dnsIp12 39 pinustamilbe10.com 151.236.14.69, 2940, 49774 NFORCENL European Union 25->39 41 geography.netsupportsoftware.com 62.172.138.35, 49780, 80 BTGB United Kingdom 25->41 43 geo.netsupportsoftware.com 25->43 59 Multi AV Scanner detection for dropped file 25->59 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5109678b00c6140a7f3183450dd0020be13d38f4ed8adcc820c2c12aa1d66ac3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=keewpcyayykau7zrqncq3uacbpqt2ohu5wfnzsbaylasviownlbq._file
Verdict:
unknown
Similar samples:
1e058d7231f3988e107157842935db6b35b3079baf30cedee7bff0fc9544c9f9
NetSupport
23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401
NetSupport
3d47aa3f5d36514cf264d75f75774318f4a00f8258c73f61631f995613f7290d
NetSupport
60c43df102c498b3c295c0c02327a94141f127d076c0a493dcc9cedc02a0b8fb
NetSupport
61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2
NetSupport
996004853edac15918294b18cc8f7145b2e4f230f83fc90314c8253a9eb3772f
NetSupport
a60f3cfa331d387f6c6f704f97320d7743d28fa3499eae89422bba890036e2a1
NetSupport
ba9dbb2b898adf2758437959eddda224bcc46b48a31c0eed57f5517cfe68f68d
NetSupport
f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783
NetSupport
+ 72 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/220719-wxlgqaggdp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
NetSupport
Malware Config
Dropper Extraction:
https://a2p2pulsepower.org/wp-content/plugins/index.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5109678b00c6140a7f3183450dd0020be13d38f4ed8adcc820c2c12aa1d66ac3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/2259060/
Cape
Cape
https://www.capesandbox.com/analysis/291976/

Comments