🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d
SHA3-384 hash: d8254750b9b71e8d323d9bef3b0b8d8944482fa0a1f8582e5bd6a6df029d9a03a0dcdd490606e1fbc120d071469da3a5
SHA1 hash: a64fca22fef49f280b17d61bc84e4f7095546101
MD5 hash: d1ac0fe6e5a468339625c6291b61b2ca
humanhash: kansas-alanine-autumn-august
File name:Rate_confirmation.pdf_2bbf.vbs
Download: download sample
Signature NetSupport
Create hunting rule
File size:1'985 bytes
First seen:2026-09-29 06:32:24 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 48:eR9dZVazRBk5OPYUsnboGiouH8VSpMVlruFk06FVLIbIEjSAH:ezdZAtBAqUYzcCMjuy06F9IbIgSo
TLSH T15241257CB0A57E636AB3E34989E4D25C13D2A4158714818FB4EDC81B7E43211776591D
Magika vba
Reporter smica83
Tags:NetSupport UKR vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89596/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cscript encrypted evasive lolbin lolbin mshta rundll32
Link:
https://www.filescan.io/uploads/6abb5ba5c71dd1bca79aa33e/reports/7a2edbdc-6413-4382-8596-0bf3cd334d78/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d
Verdict:
Malicious
File Type:
vbs
First seen:
2026-09-28T18:45:00Z UTC
Last seen:
2026-09-28T19:47:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d/results?tab=lookup
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1979250
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Creates HTA files
Creates multiple autostart registry keys
Multi AV Scanner detection for dropped file
Potential malicious VBS script found (suspicious strings)
Powershell connects to network
Sigma detected: Legitimate Application Dropped Executable
Sigma detected: Legitimate Application Dropped Script
Sigma detected: Register Wscript In Run Key
Sigma detected: rundll32 run dll from internet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Suspicious execution chain found
Uses schtasks.exe or at.exe to add and modify task schedules
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
WScript reads language and country specific registry keys (likely country aware script)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1979250 Sample: Rate_confirmation.pdf_2bbf.vbs Startdate: 29/09/2026 Architecture: WINDOWS Score: 100 130 download.youlovemybiba.com 2->130 132 geo.netsupportsoftware.com 2->132 148 Sigma detected: Register Wscript In Run Key 2->148 150 Suricata IDS alerts for network traffic 2->150 152 Multi AV Scanner detection for dropped file 2->152 154 11 other signatures 2->154 12 wscript.exe 2 2->12         started        16 wscript.exe 2->16         started        18 wscript.exe 2->18         started        20 3 other processes 2->20 signatures3 process4 file5 128 C:\Users\user\AppData\Local\Temp\705546.vbs, ASCII 12->128 dropped 162 VBScript performs obfuscated calls to suspicious functions 12->162 164 Potential malicious VBS script found (suspicious strings) 12->164 166 Windows Shell Script Host drops VBS files 12->166 170 2 other signatures 12->170 22 cscript.exe 3 12->22         started        168 WScript reads language and country specific registry keys (likely country aware script) 16->168 27 cmd.exe 16->27         started        29 cmd.exe 16->29         started        31 cmd.exe 18->31         started        33 cmd.exe 18->33         started        35 cmd.exe 20->35         started        37 cmd.exe 20->37         started        39 cmd.exe 20->39         started        41 2 other processes 20->41 signatures6 process7 dnsIp8 134 download.youlovemybiba.com 150.241.66.223, 443, 49701, 49703 KYONIXGB Germany 22->134 108 C:\Users\user\AppData\Local\Temp\update.hta, HTML 22->108 dropped 156 Creates HTA files 22->156 43 mshta.exe 2 55 22->43         started        51 2 other processes 22->51 53 3 other processes 27->53 55 3 other processes 29->55 57 3 other processes 31->57 59 3 other processes 33->59 61 3 other processes 35->61 47 conhost.exe 37->47         started        49 conhost.exe 39->49         started        file9 signatures10 process11 file12 120 C:\Users\user\AppData\...\updaterdriveon.exe, PE32 43->120 dropped 122 C:\Users\user\AppData\...\remcmdstub.exe, PE32 43->122 dropped 124 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 43->124 dropped 126 15 other malicious files 43->126 dropped 158 Creates multiple autostart registry keys 43->158 160 Bypasses PowerShell execution policy 43->160 63 powershell.exe 14 17 43->63         started        66 cmd.exe 43->66         started        68 cmd.exe 43->68         started        70 chrome.exe 1 51->70         started        signatures13 process14 dnsIp15 176 Powershell connects to network 63->176 73 tar.exe 63->73         started        76 updaterdriveon.exe 63->76         started        80 conhost.exe 63->80         started        82 wscript.exe 66->82         started        84 conhost.exe 66->84         started        178 Uses schtasks.exe or at.exe to add and modify task schedules 68->178 86 conhost.exe 68->86         started        88 schtasks.exe 68->88         started        136 192.168.2.4, 138, 443, 49681 unknown unknown 70->136 90 chrome.exe 70->90         started        signatures16 process17 dnsIp18 110 C:\Users\user\AppData\...\updaterdriveon.exe, PE32 73->110 dropped 112 C:\Users\user\AppData\...\remcmdstub.exe, PE32 73->112 dropped 114 C:\Users\user\AppData\Local\...\pcicapi.dll, PE32 73->114 dropped 118 5 other files (3 malicious) 73->118 dropped 138 192.162.199.79, 443, 49735 FEMOITGB United Kingdom 76->138 140 geo.netsupportsoftware.com 172.67.68.212, 49736, 80 CLOUDFLARENET-CloudflareIncUS Canada 76->140 172 Multi AV Scanner detection for dropped file 76->172 174 WScript reads language and country specific registry keys (likely country aware script) 82->174 92 cmd.exe 82->92         started        94 cmd.exe 82->94         started        142 download.youlovemybiba.com 90->142 144 www.google.com 142.251.154.119, 443, 49707, 49710 GOOGLE-GoogleLLCUS United States 90->144 146 2 other IPs or domains 90->146 116 Chrome Cache Entry: 298, PDP-11 90->116 dropped file19 signatures20 process21 process22 96 conhost.exe 92->96         started        98 tasklist.exe 92->98         started        100 find.exe 92->100         started        102 conhost.exe 94->102         started        104 tasklist.exe 94->104         started        106 find.exe 94->106         started       
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d
Verdict:
Malware
YARA:
1 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated Scripting.FileSystemObject T1027 T1059 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/d1ac0fe6e5a468339625c6291b61b2ca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpcjfwyddr5czo5lc6g37otd52yfecwx3rzp2ywc45giw32z6qwq._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery execution persistence rat
Link:
https://tria.ge/reports/260929-ha9zxatamb/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Discovers running processes
Executes a VBScript file via the Windows Script Host.
Adds Run key to start application
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Family: NetSupport
Malware Config
Dropper Extraction:
https://download.youlovemybiba.com/assets/pkg/package.tar.gz
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/abc492db031c7a2cbbab178dbfba63eeb0520ad7dc72fd62c2e74c8b6f59f42d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/89596/

Comments