SYMBOLCOMMON_NAMEaka. SYNONYMS
win.netsupportmanager_rat (Back to overview)

NetSupportManager RAT

aka: NetSupport
URLhaus    

Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT.

References
2023-01-06AhnLabASEC
@online{asec:20230106:distribution:dd88acd, author = {ASEC}, title = {{Distribution of NetSupport RAT Malware Disguised as a Pokemon Game}}, date = {2023-01-06}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/45312/}, language = {English}, urldate = {2023-03-20} } Distribution of NetSupport RAT Malware Disguised as a Pokemon Game
NetSupportManager RAT
2022-09-15SekoiaThreat & Detection Research Team
@online{team:20220915:privateloader:d88c7b2, author = {Threat & Detection Research Team}, title = {{PrivateLoader: the loader of the prevalent ruzki PPI service}}, date = {2022-09-15}, organization = {Sekoia}, url = {https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/}, language = {English}, urldate = {2022-09-19} } PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-05-25Medium walmartglobaltechJason Reaves, Joshua Platt
@online{reaves:20220525:socgholish:f876e0e, author = {Jason Reaves and Joshua Platt}, title = {{SocGholish Campaigns and Initial Access Kit}}, date = {2022-05-25}, organization = {Medium walmartglobaltech}, url = {https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee}, language = {English}, urldate = {2022-06-02} } SocGholish Campaigns and Initial Access Kit
FAKEUPDATES Blister Cobalt Strike NetSupportManager RAT
2022-04-11eSentireeSentire Threat Response Unit (TRU)
@online{tru:20220411:fake:e57b0f2, author = {eSentire Threat Response Unit (TRU)}, title = {{Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer}}, date = {2022-04-11}, organization = {eSentire}, url = {https://www.esentire.com/blog/fake-chrome-setup-leads-to-netsupportmanager-rat-and-mars-stealer}, language = {English}, urldate = {2022-05-24} } Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer
Mars Stealer NetSupportManager RAT
2022-04-07Avast DecodedPavel Novák, Jan Rubín
@online{novk:20220407:parrot:9c74f9b, author = {Pavel Novák and Jan Rubín}, title = {{Parrot TDS takes over web servers and threatens millions}}, date = {2022-04-07}, organization = {Avast Decoded}, url = {https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/}, language = {English}, urldate = {2022-04-08} } Parrot TDS takes over web servers and threatens millions
FAKEUPDATES Parrot TDS Parrot TDS WebShell NetSupportManager RAT
2022-04-07Bleeping ComputerBill Toulas
@online{toulas:20220407:malicious:f10fb8e, author = {Bill Toulas}, title = {{Malicious web redirect service infects 16,500 sites to push malware}}, date = {2022-04-07}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/malicious-web-redirect-service-infects-16-500-sites-to-push-malware/}, language = {English}, urldate = {2022-04-12} } Malicious web redirect service infects 16,500 sites to push malware
NetSupportManager RAT
2020-11-02SUCURIDenis Sinegubko
@online{sinegubko:20201102:cssjs:e800099, author = {Denis Sinegubko}, title = {{CSS-JS Steganography in Fake Flash Player Update Malware}}, date = {2020-11-02}, organization = {SUCURI}, url = {https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html}, language = {English}, urldate = {2020-11-04} } CSS-JS Steganography in Fake Flash Player Update Malware
magecart NetSupportManager RAT
2020-05-22Positive TechnologiesPT ESC Threat Intelligence
@online{intelligence:20200522:operation:6e4f978, author = {PT ESC Threat Intelligence}, title = {{Operation TA505: investigating the ServHelper backdoor with NetSupport RAT. Part 2.}}, date = {2020-05-22}, organization = {Positive Technologies}, url = {https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part2/}, language = {English}, urldate = {2020-11-23} } Operation TA505: investigating the ServHelper backdoor with NetSupport RAT. Part 2.
NetSupportManager RAT ServHelper
2020-03-19PrevailionPrevailion
@online{prevailion:20200319:curious:082e652, author = {Prevailion}, title = {{The Curious Case of the Criminal Curriculum Vitae}}, date = {2020-03-19}, organization = {Prevailion}, url = {https://blog.prevailion.com/2020/03/the-curious-case-of-criminal-curriculum.html}, language = {English}, urldate = {2020-06-30} } The Curious Case of the Criminal Curriculum Vitae
LALALA Stealer NetSupportManager RAT Rekt Loader
2017-09-01Palo Alto Networks Unit 42Brad Duncan
@online{duncan:20170901:eitest:6388761, author = {Brad Duncan}, title = {{EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware}}, date = {2017-09-01}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2017/09/unit42-hoeflertext-popups-targeting-google-chrome-users-now-pushing-rat-malware/}, language = {English}, urldate = {2019-12-20} } EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware
NetSupportManager RAT
2016-09-30Bleeping ComputerLawrence Abrams
@online{abrams:20160930:hacked:760d56c, author = {Lawrence Abrams}, title = {{Hacked Steam accounts spreading Remote Access Trojan}}, date = {2016-09-30}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/hacked-steam-accounts-spreading-remote-access-trojan/}, language = {English}, urldate = {2019-12-20} } Hacked Steam accounts spreading Remote Access Trojan
NetSupportManager RAT
2013NetSupport ManagerNetSupport Manager
@online{manager:2013:netsupport:f3fadef, author = {NetSupport Manager}, title = {{NetSupport Manager Website}}, date = {2013}, organization = {NetSupport Manager}, url = {http://www.netsupportmanager.com/index.asp}, language = {English}, urldate = {2020-01-07} } NetSupport Manager Website
NetSupportManager RAT
Yara Rules
[TLP:WHITE] win_netsupportmanager_rat_auto (20230125 | Detects win.netsupportmanager_rat.)
rule win_netsupportmanager_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.netsupportmanager_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb02 33c9 85c0 894e10 740f 8b4008 c7460401000000 }
            // n = 7, score = 100
            //   eb02                 | jmp                 4
            //   33c9                 | xor                 ecx, ecx
            //   85c0                 | test                eax, eax
            //   894e10               | mov                 dword ptr [esi + 0x10], ecx
            //   740f                 | je                  0x11
            //   8b4008               | mov                 eax, dword ptr [eax + 8]
            //   c7460401000000       | mov                 dword ptr [esi + 4], 1

        $sequence_1 = { 83c408 85c0 5e 7422 8b0d???????? 6a00 68???????? }
            // n = 7, score = 100
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   5e                   | pop                 esi
            //   7422                 | je                  0x24
            //   8b0d????????         |                     
            //   6a00                 | push                0
            //   68????????           |                     

        $sequence_2 = { ff15???????? 8b4330 c745fc00000000 8945ec 8b30 3bf0 7422 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b4330               | mov                 eax, dword ptr [ebx + 0x30]
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   8b30                 | mov                 esi, dword ptr [eax]
            //   3bf0                 | cmp                 esi, eax
            //   7422                 | je                  0x24

        $sequence_3 = { e8???????? 8b4340 83c404 46 83c704 3bf0 7cea }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b4340               | mov                 eax, dword ptr [ebx + 0x40]
            //   83c404               | add                 esp, 4
            //   46                   | inc                 esi
            //   83c704               | add                 edi, 4
            //   3bf0                 | cmp                 esi, eax
            //   7cea                 | jl                  0xffffffec

        $sequence_4 = { e9???????? 8d8d14fdffff e9???????? 8d8d40ddffff e9???????? 8d4de0 e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   8d8d14fdffff         | lea                 ecx, [ebp - 0x2ec]
            //   e9????????           |                     
            //   8d8d40ddffff         | lea                 ecx, [ebp - 0x22c0]
            //   e9????????           |                     
            //   8d4de0               | lea                 ecx, [ebp - 0x20]
            //   e9????????           |                     

        $sequence_5 = { e9???????? 8b4510 8b4d0c 8b17 50 51 8bcf }
            // n = 7, score = 100
            //   e9????????           |                     
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b17                 | mov                 edx, dword ptr [edi]
            //   50                   | push                eax
            //   51                   | push                ecx
            //   8bcf                 | mov                 ecx, edi

        $sequence_6 = { ff15???????? 8b565c 8b8290020000 85c0 7410 50 8b4608 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b565c               | mov                 edx, dword ptr [esi + 0x5c]
            //   8b8290020000         | mov                 eax, dword ptr [edx + 0x290]
            //   85c0                 | test                eax, eax
            //   7410                 | je                  0x12
            //   50                   | push                eax
            //   8b4608               | mov                 eax, dword ptr [esi + 8]

        $sequence_7 = { ff5208 f7de 1bf6 23f7 83c604 56 ff15???????? }
            // n = 7, score = 100
            //   ff5208               | call                dword ptr [edx + 8]
            //   f7de                 | neg                 esi
            //   1bf6                 | sbb                 esi, esi
            //   23f7                 | and                 esi, edi
            //   83c604               | add                 esi, 4
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_8 = { e8???????? 8bce e8???????? 8b4628 3bc7 7409 50 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   8b4628               | mov                 eax, dword ptr [esi + 0x28]
            //   3bc7                 | cmp                 eax, edi
            //   7409                 | je                  0xb
            //   50                   | push                eax

        $sequence_9 = { e8???????? a1???????? 85c0 7511 8b0d???????? 6a00 6a04 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   a1????????           |                     
            //   85c0                 | test                eax, eax
            //   7511                 | jne                 0x13
            //   8b0d????????         |                     
            //   6a00                 | push                0
            //   6a04                 | push                4

    condition:
        7 of them and filesize < 4734976
}
Download all Yara Rules