MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2
SHA3-384 hash: b0f184503ea1e38ac1c6e75af6e40f7948991fec9770adb33ddef4fb0d886ef37134433cf04f600d2385f3d9bd31dc59
SHA1 hash: 400b07d10b71ee63df9841ff209912f7780811cc
MD5 hash: 6732b92b4b6c8e0ae58421db70e50872
humanhash: sad-lake-mockingbird-pluto
File name:6c_19072022_091950.vbs
Download: download sample
Signature NetSupport
Create hunting rule
File size:20'650 bytes
First seen:2022-07-19 18:17:42 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:xFcE38pJdCZNRhsfqTpj/zjHuG+oY05Ad/iII5sltlk:hLqBjljk
Threatray 77 similar samples on MalwareBazaar
TLSH T15B927C6D034FA4E89773ACC88AD5AC57FB7486264A2CCAC89F70FEF62410174A0F591D
Reporter abuse_ch
Tags:NetSupport vbs


Avatar
abuse_ch
Payload URL:
https://a2p2pulsepower.org/wp-content/plugins/index.html

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291977/
Detection(s):
SecuriteInfo.com.ISB.Downloadergen80.28273.17433.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1036743
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 669237 Sample: 6c_19072022_091950.vbs Startdate: 19/07/2022 Architecture: WINDOWS Score: 100 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 Yara detected Powershell download and execute 2->49 51 Uses known network protocols on non-standard ports 2->51 8 wscript.exe 1 2->8         started        11 presentationhost.exe 2->11         started        13 presentationhost.exe 2->13         started        process3 signatures4 55 VBScript performs obfuscated calls to suspicious functions 8->55 57 Wscript starts Powershell (via cmd or directly) 8->57 59 PowerShell case anomaly found 8->59 15 cmd.exe 1 8->15         started        process5 signatures6 63 Suspicious powershell command line found 15->63 65 Wscript starts Powershell (via cmd or directly) 15->65 67 Encrypted powershell cmdline option found 15->67 69 2 other signatures 15->69 18 powershell.exe 15 33 15->18         started        23 conhost.exe 15->23         started        process7 dnsIp8 37 a2p2pulsepower.org 85.234.143.107, 443, 49758 SIMPLYTRANSITGB United Kingdom 18->37 29 C:\Users\user\AppData\...\remcmdstub.exe, PE32 18->29 dropped 31 C:\Users\user\...\presentationhost.exe, PE32 18->31 dropped 33 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 18->33 dropped 35 6 other malicious files 18->35 dropped 53 Powershell drops PE file 18->53 25 presentationhost.exe 18->25         started        file9 signatures10 process11 dnsIp12 39 pinustamilbe10.com 151.236.14.69, 2940, 49773 NFORCENL European Union 25->39 41 geography.netsupportsoftware.com 195.171.92.116, 49776, 80 BT-UK-ASBTnetUKRegionalnetworkGB United Kingdom 25->41 43 geo.netsupportsoftware.com 25->43 61 Multi AV Scanner detection for dropped file 25->61 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=medwcvfujypqqeb6rffetbdohpwtdmrj3g5y6ovskvsufe6tsora._file
Verdict:
unknown
Similar samples:
23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401
NetSupport
3d47aa3f5d36514cf264d75f75774318f4a00f8258c73f61631f995613f7290d
NetSupport
996004853edac15918294b18cc8f7145b2e4f230f83fc90314c8253a9eb3772f
NetSupport
a60f3cfa331d387f6c6f704f97320d7743d28fa3499eae89422bba890036e2a1
NetSupport
ca59f322967c867315d4f05cddcaccb771295b499477467e4e5da4978f94d94c
NetSupport
f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783
NetSupport
+ 67 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/220719-wxlgqafhe8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
NetSupport
Malware Config
Dropper Extraction:
https://a2p2pulsepower.org/wp-content/plugins/index.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetSupport

Visual Basic Script (vbs) vbs 61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2259060/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/291977/

Comments