MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb
SHA3-384 hash: 18d40e0dc72a6a272c578ab5bb7db03f67ec3c3abaafa898bb5ff0fb959095e61d936eb1fba079764e8b740211f01d4e
SHA1 hash: 7c73d7783441d0457a9c48cc76cf337af84c367c
MD5 hash: 701a3f2d613092afcd177b491e1fb843
humanhash: delaware-oven-echo-helium
File name:booking.ps1
Download: download sample
Signature NetSupport
Create hunting rule
File size:39 bytes
First seen:2026-03-17 10:30:30 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3:WIJmcLIQxdTzZFM4:WIocnu4
TLSH TNULL
Magika txt
Reporter JAMESWT_WT
Tags:booking ClickFix FakeCaptcha NetSupport ps1

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
152.89.244.70:443 https://threatfox.abuse.ch/ioc/1769070/

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b92d7f88c80c01586b15eb
Tags:
vmdetect autorun netsup madi
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69b92d722000fc76c3e5419c/reports/8d6de82c-7405-4139-9e4b-043b1b4e9ad2/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb
Verdict:
Clean
File Type:
text
Link:
https://opentip.kaspersky.com/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb/results?tab=lookup
Score:
27%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery execution rat
Link:
https://tria.ge/reports/260317-mkf7ssas71/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Drops startup file
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Downloads MZ/PE file
NetSupport
Netsupport family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/74178276aaa12c81f17a7f95747c5595cb41e45147a342a06d23b373e8ad7ceb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments