MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b41a4eb5971f4dd7b443bd68f92f6af92735d6db5a258e372d57b499882c866a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b41a4eb5971f4dd7b443bd68f92f6af92735d6db5a258e372d57b499882c866a
SHA3-384 hash: 5ef51c958113dd32387ef74b85e5b51061714cb350dc7fca231b234c43dae2799776ae18f63f422cf1301c387d9601e1
SHA1 hash: 7e47e5bd00e73bf6758ec90c50409d9e65bd25a3
MD5 hash: 904ee5da45c1127f2137c557670ec4f9
humanhash: five-island-tango-carbon
File name:33142.ps1
Download: download sample
Signature NetSupport
Create hunting rule
File size:2'971'929 bytes
First seen:2023-05-23 18:51:04 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24576:PpnJM5qB0dazVfVvKKLg2MVlY9kw9a89rS6+MAagBHMWWy/k9VFYTyKzvzYNzyfd:PaazVJK5VlYt9YAy5jMRqqo12+3IXA
Threatray 233 similar samples on MalwareBazaar
TLSH T11ED533508FAA5C7E4968A33E706F6E7D1BE09FA0900C92EA16D070D3035DF44E9BB5D9
Reporter Neiki
Tags:NetSupport

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
FR FR
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/646d0b535c09d16f6a328142/reports/3027790c-9a85-4459-a423-49e6823a58fe/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/b41a4eb5971f4dd7b443bd68f92f6af92735d6db5a258e372d57b499882c866a
Result
Verdict:
UNKNOWN
Result
Threat name:
NetSupport RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1241140
Signature
Contains functionality to modify clipboard data
Creates processes via WMI
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Powershell drops PE file
Sigma detected: Powershell drops NetSupport RAT client
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b41a4eb5971f4dd7b443bd68f92f6af92735d6db5a258e372d57b499882c866a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqne5nmxd5g5pncdxvupsl3k7ettlvw3lisy4nznk62jtcbmqzva._file
Verdict:
malicious
Similar samples:
07027d28b02d8ec7d093f85a48c18d5f96140eb4006a7071d47c4ffc01473d74
NetSupport
adf3534c37d75d16fbefd668a7b0bc2a7797315e77b2a9bf4b985884b0cafbed
NetSupport
c0a2b7fadd4a95724bde0514baca54dd68fb6aa14237df8bd65b7243e1f68b41
NetSupport
c5abef1668afbaf378e02a420224ec01850559605143c17f5831b85afe136d5b
NetSupport
c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2
NetSupport
cbbc29510831726c62aa9536660b98f97da422d90d68db61c419967b0d32994d
NetSupport
db001e5eed23e82bc4bdd96f95d6db26e8209a087a6a09ea5434346b3d7e7856
NetSupport
df5b822cfb367fb862dce788d16009b0299461c8543c5098009fb85dd2150170
NetSupport
+ 223 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/230523-xh2qtshe8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
NetSupport
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NetSupportManager RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b41a4eb5971f4dd7b443bd68f92f6af92735d6db5a258e372d57b499882c866a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments