TrojanDownloader:JS/NetSupport!MTB

TrojanDownloader:JS/Netsupport!MTB is distributed through drive-by downloads or phishing campaigns. Users encounter fraudulent prompts on compromised websites urging them to update software, which leads to the download of a malicious JavaScript file like update_required.js. Unlike TrojanDownloader:JS/NetSupportRat!MTB, TrojanDownloader:JS/Netsupport!MTB targets the script responsible for downloading the payload, not the final RAT itself. The JavaScript is obfuscated to evade signature-based detection and uses environmental checks to avoid running in sandboxed environments. 

Once launched, the script uses PowerShell or Windows command-line utilities like certutil to download additional components from threat actor-controlled servers. The downloaded payload is often a compressed archive containing the TrojanDownloader:JS/NetSupportRat!MTB or other malware. The extraction occurs in a subdirectory within %AppData%\Roaming\ , though the final payload varies based on the threat actor’s objectives 

While the downloader script itself may not establish persistence, it deploys payloads that do. The final payload creates registry entries in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure persistence. The malware communicates with C2 servers over port 443, mimicking HTTPS traffic. Known indicators include domains like kgscrew[.]com and IP addresses such as 5[.]252.177[.]111.