MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783
SHA3-384 hash: 0fd89b540d24207d0b034128cf6123346a824b224a82ee767633cdeb60abb65c7e8c3793a0d4e914737311ce291774b0
SHA1 hash: eb81de990b18215a5019bcce0e438d626cd186c6
MD5 hash: 4e4144957164f11ff4a105411e499f3f
humanhash: carpet-indigo-fanta-johnny
File name:h5jdy_19072022_095011.vbs
Download: download sample
Signature NetSupport
Create hunting rule
File size:20'815 bytes
First seen:2022-07-19 18:17:44 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:xFcE38pJdCZNRhsfqTpj/zjHuG+oY05Ad/iII5sltlE:hLqBjljE
Threatray 77 similar samples on MalwareBazaar
TLSH T1A8927D6D034FA4E99773ACC88AD5AC57FB7486264A2CCAC89F70FEF62410174A0F551D
Reporter abuse_ch
Tags:NetSupport vbs


Avatar
abuse_ch
Payload URL:
https://a2p2pulsepower.org/wp-content/plugins/index.html

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291974/
Detection(s):
SecuriteInfo.com.ISB.Downloadergen80.8361.18929.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1036742
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Delayed program exit found
Encrypted powershell cmdline option found
Multi AV Scanner detection for dropped file
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 669235 Sample: h5jdy_19072022_095011.vbs Startdate: 19/07/2022 Architecture: WINDOWS Score: 100 47 Antivirus detection for URL or domain 2->47 49 Yara detected Powershell download and execute 2->49 51 Uses known network protocols on non-standard ports 2->51 8 wscript.exe 1 2->8         started        11 presentationhost.exe 2->11         started        13 presentationhost.exe 2->13         started        process3 signatures4 55 VBScript performs obfuscated calls to suspicious functions 8->55 57 Wscript starts Powershell (via cmd or directly) 8->57 59 PowerShell case anomaly found 8->59 15 cmd.exe 1 8->15         started        process5 signatures6 65 Suspicious powershell command line found 15->65 67 Wscript starts Powershell (via cmd or directly) 15->67 69 Encrypted powershell cmdline option found 15->69 71 2 other signatures 15->71 18 powershell.exe 15 33 15->18         started        23 conhost.exe 15->23         started        process7 dnsIp8 37 a2p2pulsepower.org 85.234.143.107, 443, 49753 SIMPLYTRANSITGB United Kingdom 18->37 39 192.168.2.1 unknown unknown 18->39 29 C:\Users\user\AppData\...\remcmdstub.exe, PE32 18->29 dropped 31 C:\Users\user\...\presentationhost.exe, PE32 18->31 dropped 33 C:\Users\user\AppData\Roaming\...\pcicapi.dll, PE32 18->33 dropped 35 6 other malicious files 18->35 dropped 53 Powershell drops PE file 18->53 25 presentationhost.exe 18->25         started        file9 signatures10 process11 dnsIp12 41 pinustamilbe10.com 151.236.14.69, 2940, 49784 NFORCENL European Union 25->41 43 geography.netsupportsoftware.com 195.171.92.116, 49785, 80 BT-UK-ASBTnetUKRegionalnetworkGB United Kingdom 25->43 45 geo.netsupportsoftware.com 25->45 61 Multi AV Scanner detection for dropped file 25->61 63 Delayed program exit found 25->63 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lx4qn3gok7wxgbv6bn3rcvx45bmtu2ritxsjrgzmpyodlq266bq._file
Verdict:
unknown
Similar samples:
23c5fd678c02a42319b75ce0c9eb6c7e8da260aff6bbc658d8bc53f268c08401
NetSupport
3d47aa3f5d36514cf264d75f75774318f4a00f8258c73f61631f995613f7290d
NetSupport
61076154b44e1f08103e894a49846e3bed31b229d9bb8f3ab255654293d393a2
NetSupport
996004853edac15918294b18cc8f7145b2e4f230f83fc90314c8253a9eb3772f
NetSupport
a60f3cfa331d387f6c6f704f97320d7743d28fa3499eae89422bba890036e2a1
NetSupport
ca59f322967c867315d4f05cddcaccb771295b499477467e4e5da4978f94d94c
NetSupport
+ 67 additional samples on MalwareBazaar
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport persistence rat
Link:
https://tria.ge/reports/220719-wxlgqafhe9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
NetSupport
Malware Config
Dropper Extraction:
https://a2p2pulsepower.org/wp-content/plugins/index.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2efc8376672bf6b9835f05bb88ab7e742c9d35144ef24c4d963f0e1ae1af783

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/2259060/
Cape
Cape
https://www.capesandbox.com/analysis/291974/

Comments