MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 5


Intelligence 5 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69
SHA3-384 hash: a89e60f9f27e47e9b7630a6234dd3dbb51e41fb50ec80087a27773658af0591c9c66bfba76122e5749504f372c85e3dd
SHA1 hash: 7c08fedb37a606f4d4e7b32ca794389ed8555612
MD5 hash: aab32944cf3e4d1a01ad32fb3ee6787c
humanhash: charlie-timing-wolfram-berlin
File name:JGS_EXPRESS_INC_Broker_Carrier_Agreement.pdf.url
Download: download sample
Signature NetSupport
Create hunting rule
File size:223 bytes
First seen:2026-01-28 13:58:53 UTC
Last seen:Never
File type:
MIME type:application/x-mswinurl
ssdeep 6:JyXSvVG/FTVtORYFeJ5Zbf5oeTckGhiDWRkadI9AF:cXaVWftOOFqRzUm3CF
TLSH T186D0A7644619C1E2D29B79861600FD80A42F74555DE9894C2248CAC944C8855D544AE1
TrID 84.6% (.URL) Windows URL shortcut (11000/1/2)
7.6% (.INI) Generic INI configuration (1000/1)
7.6% (.JSON) JSON array (generic) (1000/1)
Magika internetshortcut
Reporter smica83
Tags:45-88-78-8 lucifer-now NetSupport url

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.88.78.8:443 https://threatfox.abuse.ch/ioc/1738560/

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697a1642bec9764f452f9bde
Tags:
extens trojan sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand installer-heuristic lolbin masquerade packed webdav
Link:
https://www.filescan.io/uploads/697a16434156786ccbdceb03/reports/d23f3879-72b2-4faa-bd8a-5485bfa29b3c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69
Verdict:
Malicious
File Type:
text.internetshortcut
First seen:
2026-01-28T11:24:00Z UTC
Last seen:
2026-01-30T02:31:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bxxsvtw77s5semzo3hnvets5ixh4coc273du6jumo5exxelrruq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d06f795676ffe5d9119976ceda9272ea2e7e09c2d7f63a793463ba4bdc8b8c69

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
Create hunting rule
Author:@itsreallynick (Nick Carr)
Description:Detects possible shortcut usage for .URL persistence
Reference:https://twitter.com/ItsReallyNick/status/1176229087196696577
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments