Trojan:Win32/NetSupportRat!MTB

The initial infection vector for Trojan:Win32/NetSupportRat!MTB commonly involves socially engineered payloads. Threat actors distribute the malware through deceptive prompts on compromised websites, often masquerading as mandatory browser updates. This tactic results in the download of a JavaScript file, such as Update_browser_10.6336.js, which serves as the initial loader. 

It commences when the JavaScript file runs obfuscated PowerShell commands. The primary function of this script is to retrieve the next-stage payload from a remote server under attacker control. This payload is a compressed archive, frequently identified with a generic filename like p.zip, downloaded from a designated command and control (C2) server. 

Upon retrieval, the archive contents are extracted into a newly created directory within the %AppData%\Roaming\% pathway. This directory is assigned an arbitrary name, such as divx-429, to avoid obvious detection. The extracted components constitute the necessary files for the NetSupport Manager client, repurposed for malicious remote access. Core components include the main binary client32.exe, essential dynamic link libraries (HTCTL32.DLL, PCICL32.DLL), and a Microsoft runtime library (msvcr100.dll). Operational parameters are defined in a configuration file, client32.ini, which contains the C2 server address, while a license file (NSM.lic) validates the client installation. 

To achieve persistence, the malware modifies the Windows Registry. It creates a new entry within the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key. The name of this value is variable but often correlates to the installation directory name, for example, DIVXX. The data for this value provides the full file path to the client32.exe binary, ensuring automatic execution upon user login. 

Following installation, the malware initiates outbound communication to its C2 infrastructure. Documented servers include the IP address 5[.]252.177[.]111 and domains such as kgscrew[.]com and gamefllix[.]com. Communication typically occurs over standard ports like 443, mimicking legitimate HTTPS traffic to bypass network security measures. Subsequent to a successful compromise, attackers frequently deploy supplementary tools to enhance their foothold. Observed post-exploitation activities include the installation of an OpenSSH server for persistent remote access, the use of the Impacket framework for lateral movement, and the deployment of credential-harvesting utilities like ProcDump to extract authentication data from system memory.