MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81
SHA3-384 hash:	22f6a970f823ed649dcf7a2bd2239c2cf0548ba5c806ee741440df0b00a065bad72dcf4fa7b7c6393b3e0786d0fcd5e5
SHA1 hash:	54d8be3eb5bdd4a788dcef3265cab6c314be1ccc
MD5 hash:	c80a26b806b3486c6157d8904c2e13e7
humanhash:	wisconsin-whiskey-blossom-undress
File name:	c80a26b806b3486c6157d8904c2e13e7.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	1'439 bytes
First seen:	2023-05-27 06:46:24 UTC
Last seen:	2023-05-27 08:56:53 UTC
File type:	js
MIME type:	text/plain
ssdeep	24:Q7LFycSVa4rfcGfHg+lIKS7q/CbEbrTjarIWwofHg+l8VKS7+F/Q4AFGHwNxZAFJ:QnFrafco3WKS7qa43EMS3eVKS7W/9NHB
TLSH	T14B21529815FEE3A7E78232C2B13D8955E8F1A4023288EA691C8DD5976C2185CE61A09F
Reporter	abuse_ch
Tags:	js NetSupport xoomep1-com xoomep2-com

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

271

Origin country :

NL

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cmd

Link:

https://www.filescan.io/uploads/6471a7697e6a3d9fc24931c5/reports/e9e838b1-e9d0-4a6c-82bd-45126c3a1f9d/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox NetSupport RAT

Result

Threat name:

NetSupport RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1243678

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Creates processes via WMI

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sigma detected: Powershell drops NetSupport RAT client

Snort IDS alert for network traffic

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81/

ReversingLabs TitaniumCloud Script-JS.Trojan.Netsupp

Threat name:

Script-JS.Trojan.Netsupp

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-27 06:47:07 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mqzzmogzenfld37cl7qybmyjpjtbi2d4r6b3dtamlio54vykv6aq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport persistence rat

Link:

https://tria.ge/reports/230527-hj77nsba65/

Behaviour

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

NetSupport

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://golden-scalen.com/ngg_cl.zip

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81