Top Tweets for #client32

over 1 year ago

🚨 #Obfuscated BAT file used to deliver NetSupport RAT At the time of the analysis, the sample had not yet been submitted to #VirusTotal ⚠️ 👨‍💻 See sandbox session: https://t.co/HCxbqoCgiV 🔗 Execution chain: cmd.exe (BAT) ➡️ #PowerShell ➡️ PowerShell ➡️ #client32.exe (NetSupport client) ➡️ reg.exe Key details: 🔹 Uses a 'client32' process to run #NetSupport #RAT and add it to autorun in registry via reg.exe 🔹 Creates an 'Options' folder in %APPDATA % if missing 🔹 NetSupport client downloads a task .zip file, extracts, and runs it from %APPDATA%\Application .zip 🔹 Deletes ZIP files after execution ❗️ BAT droppers remain a common choice in attacks as threat actors continue to find new methods to evade detection. Use #ANYRUN’s Interactive Sandbox to quickly trace the full execution chain and uncover #malware behavior for fast and informed response. #ExploreWithANYRUN

$anyrun_app's tweet photo. 🚨 #Obfuscated BAT file used to deliver NetSupport RAT At the time of the analysis, the sample had not yet been submitted to #VirusTotal ⚠️ 👨‍💻 See sandbox session: https://t.co/HCxbqoCgiV 🔗 Execution chain: cmd.exe (BAT) ➡️ #PowerShell ➡️ PowerShell ➡️ #client32.exe (NetSupport client) ➡️ reg.exe Key details: 🔹 Uses a 'client32' process to run #NetSupport #RAT and add it to autorun in registry via reg.exe 🔹 Creates an 'Options' folder in %APPDATA % if missing 🔹 NetSupport client downloads a task .zip file, extracts, and runs it from %APPDATA%\Application .zip 🔹 Deletes ZIP files after execution ❗️ BAT droppers remain a common choice in attacks as threat actors continue to find new methods to evade detection. Use #ANYRUN’s Interactive Sandbox to quickly trace the full execution chain and uncover #malware behavior for fast and informed response. #ExploreWithANYRUN$

Top Tweets for #client32

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users