Researchers report a NetSupport RAT campaign that uses a Pokemon-themed lure to trick targets into installing a trojanized NetSupport RAT client, granting attackers full control of the compromised device. The operation relies on ISO droppers masquerading as legitimate software, persistence mechanisms, and discovery/anti-analysis techniques to evade detection. #NetSupportRAT #PokemonLures #Maze #RagnarLocker #Andromeda #Nanocore #CirenegRAT #DarkComet
Keypoints
- Phishing-driven dropper uses a Pokemon-themed lure to coax victims into installing the trojanized NetSupport RAT client.
- NetSupport RAT is based on a legitimate NetSupport Manager and offers extensive remote-control capabilities, including real-time monitoring and screen capture.
- Campaigns employ ISO files as droppers, containing the RAT installer or a redirecting LNK to the installer (masquerading as legitimate software).
- The loader is obfuscated with the Babadeda crypter; a base64-encoded string configures the RAT’s parameters and connection details.
- Persistence is achieved via registry Run Keys and Startup Folder, plus a scheduled task with multiple triggers.
- Discovery and anti-analysis features include GetAdaptersAddresses, WMI queries, debugger checks, and process enumeration; network traffic uses non-standard ports (e.g., TCP 50275).
MITRE Techniques
- [T1219] Remote Access Software – NetSupport RAT based on NetSupport Manager provides full and complete control over the target device. Quote: “NetSupport Manager, used maliciously or otherwise, provides full and complete control over the target device.”
- [T1053.005] Scheduled Task/Job: Scheduled Task – The sample generates a scheduled task with multiple triggers. Quote: “a scheduled task with multiple triggers.”
- [T1047] Windows Management Instrumentation – Network adapter details are pulled via GetAdaptersAddresses; data gleaned via WMI queries: “SELECT * FROM Win32_ComputerSystem SELECT * FROM Win32_SystemEnclosure”
- [T1564.001] Hide Artifacts: Hidden Files and Directories – The campaign drops data/executables into %temp% and Google Temp locations for stealth. Quote: “Data files and executables are also written to %temp%. These files are all self-deleted after launch or full installation of the attacker configuration.”
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence via registry entry and a Startup folder shortcut (e.g., ~AppDataRoamingMicrosoftWindowsStart MenuProgramsStartupNetSupport.url). Quote: “Persistence for the RAT is achieved via registry entry, and a shortcut to the installed RAT executable is written to the Startup folder.”
- [T1564.003] Hide Artifacts: Hidden Window – The RAT installation is disguised to look similar to a Google Chrome installation. Quote: “The RAT installation is disguised to look similar to a Google Chrome installation.”
- [T1036] Masquerading – Disguise as legitimate software (e.g., Google Chrome installer). Quote: “The RAT installation is disguised to look similar to a Google Chrome installation.”
- [T1112] Modify Registry – Registry-based persistence via Run Keys; startup shortcut. Quote: “Persistence for the RAT is achieved via registry entry, and a shortcut to the installed RAT executable is written to the Startup folder.”
- [T1406.002] Obfuscated Files or Information: Software Packing – The sample is obfuscated via the Babadeda crypter; base64-encoded parameters used for the NetSupport connection. Quote: “The sample is obfuscated via the Babadeda crypter. When executed, a base64 encoded string is used to specify various parameters including sessionID and other critical values to the NetSupport connection.”
- [T1049] System Network Connections Discovery – The client opens a port on TCP 50275 to receive network connections. Quote: “the client opens a port on TCP 50275 to receive network connections.”
- [T1083] File and Directory Discovery – Discovery of host environment; includes GetAdaptersAddresses and WMI queries. Quote: “The RAT performs a number of discovery operations to understand its host environment.”
- [T1057] Process Discovery – Process enumeration (EnumProcesses 32-bit). Quote: “EnumProcesses (32-bit processes).”
- [T1012] Query Registry – Uses registry-based persistence and Run Keys/Startup Folder. Quote: “registry Run Keys / Startup Folder.”
- [T1571] Non-Standard Port – Uses non-standard network port for C2 (e.g., TCP 50275). Quote: “Non-Standard Port”
Indicators of Compromise
- [SHA1] Samples – 593966f38d6b062bec8534ec070a194ac3a3c3d8, 3a511941b09fdfed1b53bd89e55be7a3211b19c2, and 11 more hashes
- [DNS/Domains] Domain – she32rn1[.]com
- [File name] Droppers/Installers – CLFSECUR.EXE, client32.exe, and other installer components used in ISO-based drops