MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b33ea2eb07afc19b51be0b6b6dd412266db17fff124e0d5707edc2e27723154e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetSupport

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments

SHA256 hash:	b33ea2eb07afc19b51be0b6b6dd412266db17fff124e0d5707edc2e27723154e
SHA3-384 hash:	3c1c89e654be1f27f29083d4e944111437f64c3486c189225c0546f53321135c1422cd5cf9d2eda2eb02de51f8cfdce8
SHA1 hash:	82d2fdf69f631045f69fbeb3e504ff7b7509e298
MD5 hash:	e9c814ebeb64d99a9e0a78696f3d9a96
humanhash:	early-alanine-harry-sierra
File name:	update
Download:	download sample
Signature	NetSupport Create hunting rule
File size:	4'444 bytes
First seen:	2024-09-25 11:56:39 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:RHvWvwuwB3QGjsLCO1UD09tDdZevCO1Uw5RSXPNPpQ0bISOI03VJ8dHtLbLviCOm:RhbYs09B4rgBEnD8dHtLXAOzBCSpOI
TLSH	T1949151335A27615592128FEB95027908BA2B44FF20B62598F4E4058E3FF903F437E894
Magika	powershell
Reporter	NDA0E
Tags:	barsukenotikejik-com enotikkrolikzayac-com NetSupport ps1

NDA0E

Downloads NetSupport modules from:
https://softwaredistributiononline.com/ns/AudioCapture.dll
https://softwaredistributiononline.com/ns/HTCTL32.DLL
https://softwaredistributiononline.com/ns/NSM.LIC
https://softwaredistributiononline.com/ns/NSM.ini
https://softwaredistributiononline.com/ns/PCICHEK.DLL
https://softwaredistributiononline.com/ns/PCICL32.DLL
https://softwaredistributiononline.com/ns/TCCTL32.DLL
https://softwaredistributiononline.com/ns/client32.exe
https://softwaredistributiononline.com/ns/client32.ini
https://softwaredistributiononline.com/ns/msvcr100.dll
https://softwaredistributiononline.com/ns/nskbfltr.inf
https://softwaredistributiononline.com/ns/nsm_vpro.ini
https://softwaredistributiononline.com/ns/pcicapi.dll
https://softwaredistributiononline.com/ns/remcmdstub.exe

C2 URLs:
https://softwaredistributiononline.com/info2.php
https://softwaredistributiononline.com/info3.php

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

Vendor Threat Intelligence

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f4111456c487103d5268f7

Tags:

Generic Stealth Dropper Tori

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

dropper

Link:

https://www.filescan.io/uploads/66f3fa9be5b9f4e4c3eccf79/reports/97e5b047-bf2b-488e-bfab-41c8ec420b7e/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b33ea2eb07afc19b51be0b6b6dd412266db17fff124e0d5707edc2e27723154e

Result

Verdict:

UNKNOWN

Result

Threat name:

NetSupport RAT, HTMLPhisher

Detection:

malicious

Classification:

phis.troj

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1518315

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Creates HTML files with .exe extension (expired dropper behavior)

Sigma detected: Powershell drops NetSupport RAT client

Yara detected BlockedWebSite

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b33ea2eb07afc19b51be0b6b6dd412266db17fff124e0d5707edc2e27723154e/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wm7kf2yhv7azwun6bnvw3vasezw3c777cjha2vyh5xboe5zdcvha._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/240925-qthnrs1ejc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

Blocklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen