SYMBOLCOMMON_NAMEaka. SYNONYMS
win.netsupportmanager_rat (Back to overview)

NetSupportManager RAT

aka: NetSupport
URLhaus    

Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT.

References
2022-09-15SekoiaThreat & Detection Research Team
@online{team:20220915:privateloader:d88c7b2, author = {Threat & Detection Research Team}, title = {{PrivateLoader: the loader of the prevalent ruzki PPI service}}, date = {2022-09-15}, organization = {Sekoia}, url = {https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/}, language = {English}, urldate = {2022-09-19} } PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-05-25Medium walmartglobaltechJason Reaves, Joshua Platt
@online{reaves:20220525:socgholish:f876e0e, author = {Jason Reaves and Joshua Platt}, title = {{SocGholish Campaigns and Initial Access Kit}}, date = {2022-05-25}, organization = {Medium walmartglobaltech}, url = {https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee}, language = {English}, urldate = {2022-06-02} } SocGholish Campaigns and Initial Access Kit
FAKEUPDATES Blister Cobalt Strike NetSupportManager RAT
2022-04-11eSentireeSentire Threat Response Unit (TRU)
@online{tru:20220411:fake:e57b0f2, author = {eSentire Threat Response Unit (TRU)}, title = {{Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer}}, date = {2022-04-11}, organization = {eSentire}, url = {https://www.esentire.com/blog/fake-chrome-setup-leads-to-netsupportmanager-rat-and-mars-stealer}, language = {English}, urldate = {2022-05-24} } Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer
Mars Stealer NetSupportManager RAT
2022-04-07Avast DecodedPavel Novák, Jan Rubín
@online{novk:20220407:parrot:9c74f9b, author = {Pavel Novák and Jan Rubín}, title = {{Parrot TDS takes over web servers and threatens millions}}, date = {2022-04-07}, organization = {Avast Decoded}, url = {https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/}, language = {English}, urldate = {2022-04-08} } Parrot TDS takes over web servers and threatens millions
FAKEUPDATES Parrot TDS Parrot TDS WebShell NetSupportManager RAT
2022-04-07Bleeping ComputerBill Toulas
@online{toulas:20220407:malicious:f10fb8e, author = {Bill Toulas}, title = {{Malicious web redirect service infects 16,500 sites to push malware}}, date = {2022-04-07}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/malicious-web-redirect-service-infects-16-500-sites-to-push-malware/}, language = {English}, urldate = {2022-04-12} } Malicious web redirect service infects 16,500 sites to push malware
NetSupportManager RAT
2020-11-02SUCURIDenis Sinegubko
@online{sinegubko:20201102:cssjs:e800099, author = {Denis Sinegubko}, title = {{CSS-JS Steganography in Fake Flash Player Update Malware}}, date = {2020-11-02}, organization = {SUCURI}, url = {https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html}, language = {English}, urldate = {2020-11-04} } CSS-JS Steganography in Fake Flash Player Update Malware
magecart NetSupportManager RAT
2020-05-22Positive TechnologiesPT ESC Threat Intelligence
@online{intelligence:20200522:operation:6e4f978, author = {PT ESC Threat Intelligence}, title = {{Operation TA505: investigating the ServHelper backdoor with NetSupport RAT. Part 2.}}, date = {2020-05-22}, organization = {Positive Technologies}, url = {https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part2/}, language = {English}, urldate = {2020-11-23} } Operation TA505: investigating the ServHelper backdoor with NetSupport RAT. Part 2.
NetSupportManager RAT ServHelper
2020-03-19PrevailionPrevailion
@online{prevailion:20200319:curious:082e652, author = {Prevailion}, title = {{The Curious Case of the Criminal Curriculum Vitae}}, date = {2020-03-19}, organization = {Prevailion}, url = {https://blog.prevailion.com/2020/03/the-curious-case-of-criminal-curriculum.html}, language = {English}, urldate = {2020-06-30} } The Curious Case of the Criminal Curriculum Vitae
LALALA Stealer NetSupportManager RAT Rekt Loader
2017-09-01Palo Alto Networks Unit 42Brad Duncan
@online{duncan:20170901:eitest:6388761, author = {Brad Duncan}, title = {{EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware}}, date = {2017-09-01}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2017/09/unit42-hoeflertext-popups-targeting-google-chrome-users-now-pushing-rat-malware/}, language = {English}, urldate = {2019-12-20} } EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware
NetSupportManager RAT
2016-09-30Bleeping ComputerLawrence Abrams
@online{abrams:20160930:hacked:760d56c, author = {Lawrence Abrams}, title = {{Hacked Steam accounts spreading Remote Access Trojan}}, date = {2016-09-30}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/hacked-steam-accounts-spreading-remote-access-trojan/}, language = {English}, urldate = {2019-12-20} } Hacked Steam accounts spreading Remote Access Trojan
NetSupportManager RAT
2013NetSupport ManagerNetSupport Manager
@online{manager:2013:netsupport:f3fadef, author = {NetSupport Manager}, title = {{NetSupport Manager Website}}, date = {2013}, organization = {NetSupport Manager}, url = {http://www.netsupportmanager.com/index.asp}, language = {English}, urldate = {2020-01-07} } NetSupport Manager Website
NetSupportManager RAT
Yara Rules
[TLP:WHITE] win_netsupportmanager_rat_auto (20221125 | Detects win.netsupportmanager_rat.)
rule win_netsupportmanager_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.netsupportmanager_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 8b4754 6a00 6a0c 8d4f64 6a00 51 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b4754               | mov                 eax, dword ptr [edi + 0x54]
            //   6a00                 | push                0
            //   6a0c                 | push                0xc
            //   8d4f64               | lea                 ecx, [edi + 0x64]
            //   6a00                 | push                0
            //   51                   | push                ecx

        $sequence_1 = { e8???????? 8d4dd0 8845e8 e8???????? 8b450c 8b55d0 8d4dec }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8d4dd0               | lea                 ecx, [ebp - 0x30]
            //   8845e8               | mov                 byte ptr [ebp - 0x18], al
            //   e8????????           |                     
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b55d0               | mov                 edx, dword ptr [ebp - 0x30]
            //   8d4dec               | lea                 ecx, [ebp - 0x14]

        $sequence_2 = { f2ae 8b7df8 52 f7d1 49 8bc1 c1e902 }
            // n = 7, score = 100
            //   f2ae                 | repne scasb         al, byte ptr es:[edi]
            //   8b7df8               | mov                 edi, dword ptr [ebp - 8]
            //   52                   | push                edx
            //   f7d1                 | not                 ecx
            //   49                   | dec                 ecx
            //   8bc1                 | mov                 eax, ecx
            //   c1e902               | shr                 ecx, 2

        $sequence_3 = { 8be5 5d c3 c787d4050000ffffffff e8???????? 57 e8???????? }
            // n = 7, score = 100
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   c787d4050000ffffffff     | mov    dword ptr [edi + 0x5d4], 0xffffffff
            //   e8????????           |                     
            //   57                   | push                edi
            //   e8????????           |                     

        $sequence_4 = { e9???????? 8d4df0 e9???????? 8b45e8 50 e8???????? 59 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   8d4df0               | lea                 ecx, [ebp - 0x10]
            //   e9????????           |                     
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]
            //   50                   | push                eax
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_5 = { f2ae 8bcb 4f c1e902 f3a5 8bcb 8d8550fdffff }
            // n = 7, score = 100
            //   f2ae                 | repne scasb         al, byte ptr es:[edi]
            //   8bcb                 | mov                 ecx, ebx
            //   4f                   | dec                 edi
            //   c1e902               | shr                 ecx, 2
            //   f3a5                 | rep movsd           dword ptr es:[edi], dword ptr [esi]
            //   8bcb                 | mov                 ecx, ebx
            //   8d8550fdffff         | lea                 eax, [ebp - 0x2b0]

        $sequence_6 = { ff9200010000 33c0 5e 8b4df4 64890d00000000 8be5 5d }
            // n = 7, score = 100
            //   ff9200010000         | call                dword ptr [edx + 0x100]
            //   33c0                 | xor                 eax, eax
            //   5e                   | pop                 esi
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp

        $sequence_7 = { 8d8d0cffffff e9???????? 8d8d1cffffff e9???????? 8d8decfeffff e9???????? 8d8d4cffffff }
            // n = 7, score = 100
            //   8d8d0cffffff         | lea                 ecx, [ebp - 0xf4]
            //   e9????????           |                     
            //   8d8d1cffffff         | lea                 ecx, [ebp - 0xe4]
            //   e9????????           |                     
            //   8d8decfeffff         | lea                 ecx, [ebp - 0x114]
            //   e9????????           |                     
            //   8d8d4cffffff         | lea                 ecx, [ebp - 0xb4]

        $sequence_8 = { 8bf0 3bf3 7432 ff15???????? 8b4df0 50 51 }
            // n = 7, score = 100
            //   8bf0                 | mov                 esi, eax
            //   3bf3                 | cmp                 esi, ebx
            //   7432                 | je                  0x34
            //   ff15????????         |                     
            //   8b4df0               | mov                 ecx, dword ptr [ebp - 0x10]
            //   50                   | push                eax
            //   51                   | push                ecx

        $sequence_9 = { ff15???????? 83f801 7c19 53 8b1d???????? 57 8bf8 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   83f801               | cmp                 eax, 1
            //   7c19                 | jl                  0x1b
            //   53                   | push                ebx
            //   8b1d????????         |                     
            //   57                   | push                edi
            //   8bf8                 | mov                 edi, eax

    condition:
        7 of them and filesize < 4734976
}
Download all Yara Rules