MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5
SHA3-384 hash: 6764f2721941f2adab4e354f4d447b68f5ea55e5b58f4ddeaeaecddbecf9c7cbc1fa4b4b35fb146b0d58e04746846b96
SHA1 hash: 5f15478522db58b2333258cc914d0d3864c77c7a
MD5 hash: bec3e6e2236865db5003487b4963d4b1
humanhash: quebec-red-beer-quebec
File name:a2p2pulsepower.org_wp-content_plugins_index.html.ps1
Download: download sample
Signature NetSupport
Create hunting rule
File size:3'795'401 bytes
First seen:2023-08-30 16:47:17 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 49152:zingMoGu+p6PAh6b92q8zbOy0K/WQutmxbC7r3DKyGR+Xcac0Xd:V
Threatray 356 similar samples on MalwareBazaar
TLSH T1300633321D667ABB1374C51371AF9F2E0E30FE878054FC9AB6B256D01745F6634AB828
Reporter TomU
Tags:NetSupport ps1


Avatar
TomU
Source:
https://urlhaus.abuse.ch/url/2259060/

C2:
pinustamilbe10[.]com:2940
pinustamilbe12[.]com:2940

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
CH CH
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.40031210.15261.14576.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control dropper greyware keylogger lolbin masquerade packed powershell remote
Link:
https://www.filescan.io/uploads/64ef72c21d3a8c6c1217f7a5/reports/73417744-e2a6-460f-9576-975b2ee4728f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5
Result
Verdict:
MALICIOUS
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1300539
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to modify clipboard data
Delayed program exit found
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Powershell drops NetSupport RAT client
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5/
Threat name:
Script-PowerShell.Trojan.PShell
Create hunting rule
Status:
Malicious
First seen:
2022-07-19 20:41:16 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5p6zt6m5hk2nlyd5gb4p7hguogpid6qz7crrjqsy2lmk4v2f7kq._file
Verdict:
malicious
Similar samples:
1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5
NetSupport
1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0
NetSupport
2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9
NetSupport
2e7c06e3cf60da0c6c3f09a015aba51456aa68242cce644df3de822c0b6471fa
NetSupport
a5242c3e2661f04e61017cbb2eda4f8e1ae13ed7737a6e2e0eb278eb40cb81d9
NetSupport
c69642d092f9320dbc90d38fbecc3f212e4211d4f1e98e69f253d034ec77f960
NetSupport
d5f31838190076f9513334c1d93775aae4449c42cfdb4f8e7a09051ff723d73e
NetSupport
db001e5eed23e82bc4bdd96f95d6db26e8209a087a6a09ea5434346b3d7e7856
NetSupport
dc9b2d9b657585c8dd28efaec75415442499f40fee5f0b8bb3e05b759c54541c
NetSupport
df4d902f7da2a7da84e00f34ecda7924ad27f5fef1c5397a0bfd15618f6b4f70
NetSupport
+ 346 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/230830-va38ksgb7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
NetSupport
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9f5feccfcce9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetSupport

PowerShell (PS) ps1 9f5feccfcce9d5a6af03e983c7fce6a38cf40fd0cfc518a612c696c572ba2fd5

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments