MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876
SHA3-384 hash: 8f81814c001bff156489a5c350f604a5238d745e2fbac006572ff9a0062c35cc85e4264704cf4be49f9f77f33fb41c82
SHA1 hash: ac7892f0074ff6c62697083f887b1335ba62c7d8
MD5 hash: b99fa8867399e47a93990fd20ab7720a
humanhash: finch-video-network-mountain
File name:965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876.msi
Download: download sample
Signature NetSupport
Create hunting rule
File size:6'889'472 bytes
First seen:2026-06-05 11:51:12 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:3/EhnCSlllllllllllllllll/ss3Vfg2UNRtM4PABjrb5Iq7UgIWihxg8FnuAq4B:qnFfgNVaVTodg8Y3LOH
Threatray 883 similar samples on MalwareBazaar
TLSH T1CD6612BB6A7C4DB5C83CE47E57139F52D9B8F8411B6C648D0D52B3B02962A716B3E038
TrID 53.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
39.2% (.MSP) Windows Installer Patch (44509/10/5)
7.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter JAMESWT_WT
Tags:176-65-144-30 dkilkamajsiot-com lopstmisot.com msi NetSupport

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/54711f29-de48-4ef5-b947-75eded03b353/
Detection:
NetSupport
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69174/
Detection(s):
SecuriteInfo.com.Other.Malware-gen.76751555.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a22b84357b7bf261d612d72
Tags:
shellcode netsup trojan virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug base64 expand fingerprint installer lolbin overlay packed wix
Link:
https://www.filescan.io/uploads/6a22b840099ef368af21c6b4/reports/a92a1d87-d0cb-49ff-8054-7f0d164626b7/overview
Verdict:
Suspicious
Labled as:
TR/Malware
Link:
https://www.hybrid-analysis.com/sample/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876
Verdict:
Malicious
File Type:
msi
First seen:
2026-06-01T18:01:00Z UTC
Last seen:
2026-06-05T09:07:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Scar.uqvx Trojan.Win32.Scar.uqvw Backdoor.RABased.HTTP.C&C PDM:Trojan.Win32.Generic RemoteAdmin.NetSup.HTTP.C&C not-a-virus:HEUR:RemoteAdmin.Win32.NetSup.gen
Link:
https://opentip.kaspersky.com/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876/results?tab=lookup
Score:
66%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876/
Verdict:
Malicious
Threat:
Family.NETSUPPORT
Link:
https://tip.neiki.dev/file/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-01 21:20:55 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
8 of 36 (22.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=szlirjg4rl4qmb7iys3jz3zkfi5nvjhwlmivgmwkwcyekngrrb3a._file
Verdict:
malicious
Label(s):
netsupportmanagerrat
Create hunting rule
Similar samples:
3e041fca1afb1896f9fa534df0d56b872d3b13f724ff10255f4b669cd4aef2f6
NetSupport
47cae3c0b59f0e6a33e7aed184fafd9b978b049a00a88ce1e93ec1ef538fff67
NetSupport
60432d6eb939fc6d96684046071d237d0141480e7af43c623eabfa9e7ff33cac
NetSupport
69fb8fb0615a92bac3534188fea232b6a6230fb7ee0cd11e931cb4ba383227d0
NetSupport
9dc129be20fa669fc730b8364b83ecad913acd1ad1706b9deb670dbe104fde12
NetSupport
e28bc04a6fab575541b384eb10794fb2f581a0e731f3236cab97009096c7a0ec
NetSupport
ea701a593942223d89f967310be0a5f80e941a68589e9786e6fd3c91ee6648ad
NetSupport
error
NetSupport
+ 873 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery persistence privilege_escalation rat
Link:
https://tria.ge/reports/260605-n1dmaaes61/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Family: NetSupport
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/965688a4dc8af90607e8c4b69cef2a2a3adaa4f65b115332cab0b04534d18876

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69174/

Comments