Keypoints
- Initial infection uses heavily obfuscated JavaScript executed via Windows Script Host (wscript.exe).
- JavaScript launches PowerShell with ExecutionPolicy Bypass to download payloads and supporting files (or falls back to bitsadmin).
- Downloaded payload is the NetSupport client (client32.exe), placed in hidden directories under %AppData% (e.g., MsEdgeSandbox or D) for persistence.
- Scripts set directory attributes to Hidden and create registry Run keys to ensure autostart at user logon.
- Variant differences: Variant 1 places client32.exe in an MsEdgeSandbox folder; Variant 2 downloads base64 content, writes a p.zip into an AppDataD folder, extracts it, then runs client32.exe.
- Client32.exe connects to remote C2 infrastructure (example domain jokosampbulid1.com and IP 45.15.158.212) over port 1412 using NetSupport protocol strings.
- IOCs include file hashes for JS and EXE samples, download URLs/domains, and the C2 IP and port.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – Obfuscated JavaScript and PowerShell are used to execute commands and orchestrate the infection (‘invokes the Windows Script Host (wscript.exe)’ and ‘powershell.exe -ExecutionPolicy Bypass -V’).
- [T1105] Ingress Tool Transfer – PowerShell downloads the NetSupport payload and ancillary files from attacker-controlled URLs (‘PowerShell proceeds to download the NetSupport payload’ and ‘downloads Client32.exe … from https://tukudewe.com/js/h3b2_jsg’).
- [T1027] Obfuscated Files or Information – Attackers deliver encoded/obfuscated JavaScript to evade detection (‘obfuscated JavaScript files’).
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The script adds a registry entry to run client32.exe at startup (‘adding a Windows registry entry for automatic execution’).
- [T1564.001] Hide Artifacts: Hidden Files and Directories – The installer sets directory attributes to Hidden and stores payloads under AppData (‘sets the attributes of a directory to ‘Hidden’’).
- [T1218] System Binary Proxy Execution – Legitimate system utilities (wscript.exe, bitsadmin) are abused to execute code and retrieve files (‘invokes the Windows Script Host (wscript.exe)’ and ‘uses ‘bitsadmin’ for file downloads’).
- [T1071.001] Application Layer Protocol: Web Protocols – The NetSupport client communicates with C2 over HTTP-like traffic on port 1412 (‘Client32.exe establishes a communication channel with a remote server located at IP address 45.15.158.212 on port 1412’).
- [T1036] Masquerading – The threat uses a legitimately signed NetSupport binary to blend with benign software (‘Client32.exe is legitimately signed’).
Indicators of Compromise
- [Domain/URL] Download and configuration sources – tukudewe[.]com/js/h3b2_jsg, hxxps://svirtual[.]sanviatorperu[.]edu[.]pe/readme[.]txt, jokosampbulid1[.]com (C2/domain in INI).
- [IP] C2 server – 45.15.158.212 (communicates on port 1412 to NetSupport console addresses).
- [File names/paths] Deployed payloads and persistence locations – client32.exe, client32.ini, NSM.LIC placed under %AppData% (e.g., MsEdgeSandbox or AppDataD) and other AppDataRoaming paths.
- [Hashes] Sample SHA256 values – JS: 5ffb5e9942492f15460e58660dd121b31d4065a133a6f8461554ea8af5c407aa; EXE: 89F0C8F170FE9EA28B1056517160E92E2D7D4E8AA81F4ED696932230413A6CE1; Variant 2 JS hashes include 48bc7663…a89a and 73e0975c…c4f9.
The technical infection chain begins when an obfuscated JavaScript file executes via wscript.exe and launches PowerShell with ExecutionPolicy Bypass. The script decodes and constructs URLs, then uses PowerShell (or bitsadmin when PowerShell download primitives aren’t available) to retrieve payload components—typically client32.exe plus supporting DLLs, INI, and LIC files—and writes them into user-writable AppData locations. The JavaScript employs base64 decoding and custom XOR-style decoding routines to hide URLs and commands prior to execution.
Two main variants were observed: Variant 1 downloads files directly and places client32.exe in a hidden MsEdgeSandbox subfolder under %AppData%, registering a Run key for persistence; Variant 2 fetches a remote text file, decodes base64 into a p.zip archive placed in %AppData%D, extracts it, and executes client32.exe from that folder. Both variants set directory attributes to Hidden and attempt to launch the NetSupport client immediately after extraction, using Start-Process or direct execution checks (Test-Path / Start-Process).
Post-deployment behavior includes NetSupport client communication to remote console addresses and an identified C2 at 45.15.158.212:1412 (domain jokosampbulid1.com referenced in client32.ini). The attackers leverage a legitimately signed NetSupport binary to reduce suspicion while using system utilities (wscript.exe, bitsadmin) and obfuscated scripts to evade detection. Notable IOCs: download domains (tukudewe[.]com, svirtual[.]sanviatorperu[.]edu[.]pe), C2 IP 45.15.158.212, and the file hashes listed above for JS and EXE samples.