MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetSupport

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 5 File information Comments

SHA256 hash:	f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b
SHA3-384 hash:	8c72cbc53da794637c0358144ebc8857d1fcbc7c88ba35b5207f26a7bbde77b553110874a6e687e671865c5854863f2a
SHA1 hash:	96906b521747f0cb3b79bf410a9d6dda6ede9c7d
MD5 hash:	2eff1b9748fca669dbc0dc157d6629ac
humanhash:	beer-low-cup-twelve
File name:	squ22.ps1
Download:	download sample
Signature	NetSupport Create hunting rule
File size:	7'289'165 bytes
First seen:	2025-12-04 13:08:51 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	49152:geQmX3yXU+yY/F4+9J5Py/nkOtAT9qN5izc829/EvUw2Z2ORDHHIS8H4l/TwD7mE:E
TLSH	T165767EB284576C37BD5D384B90042FA29E69164B67188F46FB303779B2EC951DE3C8B8
Magika	powershell
Reporter	smica83
Tags:	automarketingsales-com NetSupport ps1

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
87.120.93.222:443	https://threatfox.abuse.ch/ioc/1667660/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NetSupport

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e57a68cc-ecac-4494-81c5-d36acbb3d547/

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693187fe70ad947a38c8e8f5

Tags:

vmdetect autorun netsup madi

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm anti-vm base64 base64 cmd control cscript dropper evasive evasive expired-cert exploit explorer fingerprint fingerprint hh keylogger lolbin netsupportmanager obfuscated overlay packed remoteadmin unsafe wscript

Link:

https://www.filescan.io/uploads/693187fcd12d1c79d4292d73/reports/3a51c9ed-ca61-480f-b976-7542a3ddc73f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b

Verdict:

Malicious

File Type:

ps1

First seen:

2025-12-04T10:41:00Z UTC

Last seen:

2025-12-04T12:15:00Z UTC

Hits:

~10

Detections:

Backdoor.Win32.RABased.a Backdoor.RABased.HTTP.C&C PDM:Trojan.Win32.Generic RemoteAdmin.NetSup.UDP.C&C RemoteAdmin.NetSup.HTTP.C&C

Link:

https://opentip.kaspersky.com/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b/results?tab=lookup

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Base64 Block Base64 Payload Contains Base64 Block Executable Invalid PE PE (Portable Executable) PowerShell

Link:

https://app.malva.re/file/2eff1b9748fca669dbc0dc157d6629ac

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b/

Verdict:

Malicious

Threat:

Family.NETSUPPORT

Link:

https://tip.neiki.dev/file/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b

Threat name:

Script-PowerShell.Trojan.Heuristic

Status:

Malicious

First seen:

2025-12-04 05:30:10 UTC

File Type:

Text (PowerShell)

AV detection:

5 of 24 (20.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6msmiwapke6txozjg7ajw6yd7acqlxlrqcfyqaltfocpj3hd3ynq._file

Result

Malware family:

netsupport

Score:

10/10

Tags:

family:netsupport discovery execution rat

Link:

https://tria.ge/reports/251204-qdxgzsey4d/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Drops startup file

Executes dropped EXE

Loads dropped DLL

NetSupport

Netsupport family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NetSupportManager RAT

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NetSupportRAT_Config Create hunting rule
Author:	abuse.ch

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetSupport

ps1 f324c4580f513d3bbb2937c09b7b03f80505dd71808b8801732b84f4ece3de1b

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample