Fake MP4 Files Hide PowerShell Payloads That Install NetSupport Clients
Summary
Censys traced a campaign using PowerShell loaders and unplayable MP4 carriers to deliver NetSupport clients. The analysis identified 18 builds across 40 live endpoints and describes the infection chain, persistence, C2 infrastructure, and detection clues.
Key points
- A first-stage PowerShell script retrieves a fake MP4 from the same host, then extracts an encrypted payload from a build-specific ISO-BMFF uuid box.
- The 6.5 MB carrier passes basic file-type checks but cannot play; its uuid box contains compressed PowerShell that expands to nearly 17 MB.
- The scripts use environment checks, hide the console, and clear RunMRU history; the exact initial lure was not captured, though Run-dialog execution is inferred.
- The final stage installs NetSupport Manager silently in a randomized Public-folder subdirectory and persists through a Run key named SecurityHealth.
- Censys identified 18 builds distributed across 40 live endpoints, with 14 carrier URLs and two C2 gateways; one gateway was active and the other staged without an active DNS record.
- Detection opportunities include identifying purported MP4 files that fail decoding or store nearly all their data in uuid boxes; the payload can be unpacked statically using its embedded XOR key.
- Carrier rotation can break older deployments when their parser cannot find its build-specific selector.
Article Details
- Attack Vectors
- A PowerShell first stage is served as raw text/html and retrieves a fake MP4 carrier from the same host.
- The second-stage parser extracts an encrypted PowerShell payload from a build-specific ISO-BMFF uuid box in the non-playable MP4 file.
- The scripts install a NetSupport Manager client configured for silent operation and persistence through the SecurityHealth Run key.
- The article infers a possible Windows Run-dialog entry point from RunMRU cleanup, but says the lure and exact social-engineering pretext were not captured.
- Defensive Notes
- Flag files identified as MP4 that fail to decode or contain nearly all their data in uuid boxes.
- The article says the embedded XOR key can be applied to the uuid-box content to recover the payload without executing it.
- Monitor for the described SecurityHealth Run-key persistence, RunMRU cleanup, and related run-once markers under %ProgramData%.
- Carrier rotation can break older deployments because the parser requires a build-specific uuid selector.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 2oauth[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | brevantweuijdis[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | brmconfig[.]com | Stage-1 delivery domain and host for a malicious carrier URL. |
| DOMAIN | ceelorn[.]com | Furniture-store decoy domain identified among supporting assets in the tracked infrastructure. |
| DOMAIN | gojirotomiodid[.]com | Active C2 gateway domain used by the NetSupport client. |
| DOMAIN | kolitersdones[.]com | Staged secondary C2 gateway domain defined in the client configuration. |
| DOMAIN | leybers[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | liviliy[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | lozopro[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | lumirevax[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | lumirevion[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | meeggs[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | mimede[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | miralunexerfty[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | mmm-vps[.]online | Previous decoy domain hosted on the C2 origin. |
| DOMAIN | nexorivapgfk[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | permanenttrajectories[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | silvariona[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | silvarvexa[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | solaventro[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | soltrivena[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | solvariquejio[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | talmorvexa[.]world | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | tervixacom[.]com | Stage-1 delivery domain serving the initial dropper. |
| DOMAIN | tidalcoastapparel[.]com | Stage-1 delivery domain and host for a malicious carrier URL. |
| DOMAIN | update[.]maxintora[.]com | Stage-1 delivery hostname serving the initial dropper. |
| DOMAIN | virellixerxa[.]com | Stage-1 delivery domain serving the initial dropper. |
| HOSTNAME | 1c[.]maxintora[.]com | Stage-1 delivery hostname serving the initial dropper. |
| HOSTNAME | www[.]maxintora[.]com | Stage-1 delivery hostname serving the initial dropper. |
| IPV4 | 144[.]31[.]106[.]164 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 176[.]65[.]144[.]164 | C2 origin server for the active gateway. |
| IPV4 | 178[.]16[.]52[.]165 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 2[.]26[.]252[.]75 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 2[.]26[.]252[.]95 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 2[.]27[.]160[.]137 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 31[.]76[.]103[.]182 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 67[.]217[.]228[.]22 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 85[.]239[.]144[.]68 | Stage-1 delivery host and identified delivery origin. |
| IPV4 | 89[.]34[.]90[.]111 | Stage-1 delivery host and carrier host used to distribute the payload. |
| IPV4 | 91[.]92[.]240[.]175 | Stage-1 delivery host serving the initial dropper. |
| IPV4 | 91[.]92[.]34[.]109 | Stage-1 delivery host serving the initial dropper. |
| SHA256 | 07887055939e238184514110da990226b02e804e2371cb309487f7159171a3e7 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f | SHA-256 hash of a file dropped with the NetSupport payload (PcIchEK.dLL). |
| SHA256 | 13fc18e817241856dcef3989d6986a2dd428f3f4e31a4815723ea9510999a61c | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 1e9e7cdedcd4d20eb846a0268bccdb6aa817662516fb7cf62be930031c2c1885 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 2c24d7a819f8d15a1104875e20b7831be9a02580c01a349f6e39f3790b41b81c | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5 | SHA-256 hash of a file dropped with the NetSupport payload (aUdiocaptUrE.DlL). |
| SHA256 | 2d7285c93866597e28c4686194456e9a6eb22fe80287461990da13dab1a9e0b5 | Fingerprint of a TLS certificate associated with the tracked decoy infrastructure. |
| SHA256 | 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689 | SHA-256 hash of a file dropped with the NetSupport payload (pCicApi.dll). |
| SHA256 | 2edf10f0af08c32b7721becc063297d09362e76e1f5a18f0d81837752363b578 | SHA-256 hash of a file dropped with the NetSupport payload (WdaG.dll). |
| SHA256 | 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9 | SHA-256 hash of a file dropped with the NetSupport payload (vK_sWiftshADEr_Icd.jSon). |
| SHA256 | 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b | SHA-256 hash of a file dropped with the NetSupport payload (NSm_VprO.ini). |
| SHA256 | 512651fc5770932be61f513294fb738216d3ba923bda47bfcd5b328e2fc5636c | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 533428a3cf69e6fbf7a0b34f8915f8b9f6ba2e012ab8c9172e636f76b0f1d565 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422 | SHA-256 hash of a file dropped with the NetSupport payload (apP.eXE). |
| SHA256 | 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8 | SHA-256 hash of a file dropped with the NetSupport payload (PcIcl32.DLL). |
| SHA256 | 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269 | SHA-256 hash of a file dropped with the NetSupport payload (HtCtl32.DLL). |
| SHA256 | 6c7fc234ac22ff244dfd220abdf1de3e987a4e785f65dd5a0bff1c639521a10b | SHA-256 hash of the malicious fake MP4 carrier file. |
| SHA256 | 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299 | SHA-256 hash of a file dropped with the NetSupport payload (tCctl32.DLL). |
| SHA256 | 84ad46c293d749dbacc68a3bcf4a6a964343aa444a3b12e103cfe8f962f24762 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 | SHA-256 hash of a file dropped with the NetSupport payload (mSvCr100.dLL). |
| SHA256 | 9862075e68c565d5ad78b8a0dcf6c193092103c9607899c72eefa482b9c8f008 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | 98cdd6ef9f5e6c06154423ab221550b683f2a4c9018d88ffcce085f92be88b6d | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | aa4fc4eb78d08de797220a8b9c1db3f8a584ffcb85dda47b71a11eb306280395 | SHA-256 hash of a file dropped with the NetSupport payload (vk_SwifTsHaDEr.Dll). |
| SHA256 | b0199da4b67416f24f3d235b4d6d64d2b9cff96f3e38141e3920b90b5bf633e6 | Fingerprint of a port-1010 banner associated with the tracked infrastructure. |
| SHA256 | b0935a6e5a81f3bed34367ebb87a96543a5a2a2b2fe4596e96e655b7715a3e28 | SHA-256 hash of a file dropped with the NetSupport payload (REW.BIn). |
| SHA256 | b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2 | SHA-256 hash of a file dropped with the NetSupport payload (rEmCmDstub.eXE). |
| SHA256 | b13da09f347597ea72d3ab075265bb37ae86c24f8c8cc6545e5255c9703dee1d | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | b59c9d532b2593cb0331f2f97f68896702bb5e8e868e2f07913542e4cbf7e195 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | bf3da65748ada560e893f4952c6bafab53ebf1b888a535092d2815f0f93ec781 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | c32d53280bca6e28060c44c43bd688a7d36e315909bb36ddaebb4d6517debeae | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | c36b5c170d1e59a957fc67f17df28605e275ec6e01f3d4c03531f6fd251c5189 | SHA-256 hash of a file dropped with the NetSupport payload (VUlkan-1.dll). |
| SHA256 | ce61f3c40a71659843ad0defa40e226ba7d51b594ce09af4e496c661c6b7a09f | SHA-256 hash of the recovered stage-3 script. |
| SHA256 | d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368 | SHA-256 hash of a file dropped with the NetSupport payload (NsKBflTR.inF). |
| SHA256 | da7c33e5770216c550cc6dd67a1fc3194a10102e6f064df11f6241fe24c999c5 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | dadc9e33f8a1063c7cbd696e7527b45169075c708870b1b00f0cccddede1f1fb | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | e09980d1b1c508eb29d2931ac92f8d0a7e49ca5fe6ab6277fabf097a0b033b63 | SHA-256 hash of a file dropped with the NetSupport payload (NsM.LIC). |
| SHA256 | e0a40fb1573c73316920c296574b90cc52072e337b5c3e5b16355dfc3e306c44 | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d | SHA-256 hash of a file dropped with the NetSupport payload (NsM.ini). |
| SHA256 | e6b595c19b931960c18d562fe16bd4fa05d724b812d10945c2f965bf836783a8 | SHA-256 hash of a file dropped with the NetSupport payload (WebVIew2_iNtEgRatION.DLl). |
| SHA256 | eb819bf728b64b98a1c7e91e7da428addb8108a1ccd9500023952084e5a036ca | SHA-256 hash of a stage-1 dropper build. |
| SHA256 | edb68fc8857d9c789c7cac806ccf988008a898bf5e8fe61908f558666eceefed | SHA-256 hash of a file dropped with the NetSupport payload (gxjee.ini). |
| SHA256 | ee2c978c13fb248005b9c5d82b231fc7b38f9a3281ff1f73132b0ec0363b0b18 | SHA-256 hash of a stage-1 dropper build. |
| URL | hxxp[:]//89[.]34[.]90[.]111/tzast[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//approvalrequest-api[.]com/333[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//approvalrequest-api[.]com/55555555[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//binance-idexchange[.]com/333[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//fdn4apex[.]com/fdn4apex[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//google[.]2oauth[.]com/go[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//karlenagida[.]com/123[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//karlenagida[.]com/player[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//tidalcoastapparel[.]com/s[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//usersecuritycheck[.]com/12[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//web02message[.]com/web02message[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxp[:]//x2664[.]com/x2664[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxps[:]//brmconfig[.]com/video[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
| URL | hxxps[:]//hurmadll[.]com/twenty[.]mp4 | Stage-2 carrier URL hosting the malicious fake MP4 payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe PowerShell payload is encoded, compressed, and encrypted within a private uuid box in a fake MP4 carrier.T1036.005 · Match Legitimate Resource Name or LocationThe persistence value is named SecurityHealth to masquerade as the Windows Defender tray process.T1059.001 · PowerShellThe delivery chain uses PowerShell stages to check the environment, retrieve and parse the carrier, and deploy the client.T1105 · Ingress Tool TransferThe first stage retrieves a fake MP4 carrier from the delivery host, and the parser extracts the embedded payload.T1140 · Deobfuscate/Decode Files or InformationThe chain decodes a base64 PowerShell stage and applies an embedded XOR key to recover the encrypted payload.T1547.001 · Registry Run Keys / Startup FolderThe script establishes persistence through the HKCU Run key using the SecurityHealth value.
Vendors
Products
Microsoft WindowsThis suggests the chain begins with a command executed via the Windows Run dialog, though the exact social engineering pretext is unknown.NetSupport ManagerEach build ultimately installs a NetSupport Manager client configured to operate silently and communicate through two gateway domains registered just 77 seconds apart.PowerShellThis chain leverages a Powershell loader to deliver a payload in a fake MP4 (video file).