MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9
SHA3-384 hash:	9d1a52a49f1cfe312e85ed67ff075f4093327686eb0ca011d5c6f8bac6c43e4c643c88c81c4298ba79f784588e63187a
SHA1 hash:	a490617c99c1a1f999b42d989d69afebd51bd7bf
MD5 hash:	a2ae3848e94e1b993e92be023791103d
humanhash:	green-kentucky-green-magnesium
File name:	A0-6A086A5-A4djfhhryy-45.ps1
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	4'499'621 bytes
First seen:	2026-10-07 04:14:06 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24576:BNE7gjh9DA9d9Rj9ChcON6nGN09ZJ9896b959ACuJscq9m9KUr9FGE9HuPIxPzaT:C
TLSH	T1402682D97AC426F05929ABDC934774CD0794A13E6FBB280D02E1487D3D2AE1726E4CBD
Magika	powershell
Reporter	aachum
Tags:	194-113-235-125 dropped-by-ACRStealer NetSupport ps1

iamaachum

https://reserved.brightwell.zone/A0-6A086A5-A4djfhhryy-45

NetSupport C2: 194.113.235.125

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

140

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Win.Downloader.Emmenhtal-10044033-0

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad026576f551121ba15a23f

Tags:

outbrowse vmdetect netsup

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader emmenhtal encrypted obfuscated

Link:

https://www.filescan.io/uploads/6ac5c722d8ce7d0cbb2f5d75/reports/6ba1d06b-5503-4740-aa1f-476d07b95609/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

First seen:

2026-10-07T02:09:00Z UTC

Last seen:

2026-10-07T04:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9/results?tab=lookup

Joe Sandbox NetSupport RAT

Result

Threat name:

NetSupport RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1983339

Signature

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9/

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-27 01:21:42 UTC

File Type:

Text (PowerShell)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yv72ip7hfh6elldsk6mkh4jnd2x4x2nzdqkai3uyjbidhs36j7eq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport discovery execution rat

Link:

https://tria.ge/reports/261007-ettv9abw51/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Family: NetSupport

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.25

Link:

https://yomi.yoroi.company/submissions/c57fa43fe729fc45ac725798a3f12d1eafcbe9b91c14046e98485033cb7e4fc9