We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
TrojanDownloader:PowerShell/NetSupport.GP!MTB
Aliases: No associated aliases
Summary
TrojanDownloader:PowerShell/NetSupport.GP!MTB is a variant of NetSupport!MTB which is based around the PowerShell scripting language that reaches and installs components of the NetSupport Manager remote access tool which has been weaponized to perform as a remote access trojan (RAT). This trojan propagates via phishing emails with malicious attachments, or compromised websites that trick the users into running malicious PowerShell scripts.
The script calls upon the download and installation of the Trojan:Win32/NetSupportRat!MTB, which allows for any unauthorized remote control and data theft, as it allows the threat actor to move laterally within that network. The "!MTB" suffix refers to the fact that the detection is based on a machine learning classification method, a tree method - that identifies malicious signatures based on behavioral analysis rather than static signatures.
- Disconnect from the network to prevent lateral movement or data exfiltration.
- Use Task Manager to end tasks related to wscript.exe, cscript.exe, or client32.exe.
- Delete registry keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
- Remove scheduled tasks created by the PowerShell script.
- Erase all files in %AppData%\Roaming\ subdirectories, including client32.exe, DLLs, and configuration files.
- If critical files were modified, restore from clean backups after eradication.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
