NetSupportManager RAT

Malware Family

391 indicators of compromise attributed to NetSupportManager RAT across abuse.ch threat intelligence feeds.

Domains

133

IPs

231

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (133)IPs (231)URLs (16)Hashes (11)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

Indicator	Type
asjkfalasfkaksflalaf.com	domain
asfasfqwf.com	domain
rentalcentrals.com	domain
uuaa.faser-tech.info	domain
mher.club	domain
hdudidjdjdndjdjd.com	domain
jasjdpoekkqwda.com	domain
bryonsad.net	domain
feersona.net	domain
tiqwtkmma.com	domain
ms-scedg.com	domain
kiskapeskaloska.com	domain
chrm-srv.com	domain
dkilkamajsiot.com	domain
bookstablesoon.com	domain
alfacoockie.com	domain
asqmvmastt.com	domain
tamweelke.com	domain
asdasfa.com	domain
msiulosjudiid.com	domain
143.92.169.73	ip
167.148.201.142	ip
122.99.131.253	ip
220.76.180.114	ip
62.156.170.137	ip
107.22.165.49	ip
102.98.89.21	ip
2.137.3.71	ip
183.96.100.53	ip
200.152.101.176	ip
187.156.70.182	ip
5.152.16.189	ip
91.211.251.249	ip
193.19.242.55	ip
41.143.245.16	ip
172.94.9.4	ip
64.188.69.73	ip
45.227.254.10	ip
64.23.97.215	ip
102.98.197.191	ip
http://verifyhumanbot.com/gggs.7z	url
https://daskljtitaskastvv.pro/dsasfd555.js	url
http://91.92.34.228/test22.txt	url
http://us-addnewdevice.com/Vzj72DFgvUe1Psg5	url
http://193.143.1.21/fakeurl.htm	url
https://us-addnewdevice.com/dl-callback/peevmnpz-psenf5s7-927uja3p-uey4ex9n/setup.msi/e5cdedc2f6f167f2bf343a5bb57aa7f6	url
http://144.31.207.34/f.GRE	url
https://cpajoliette.com/d.js	url
https://xrplnode.dev/xrpl.php	url
https://mysite2-1iz.pages.dev/index/	url
http://google2oauth.com/google.txt	url
https://xrplnode.dev/install	url
https://pub-f2969eb764264a9280dffa75e6803e93.r2.dev/setup.msi	url
http://193.143.1.21:443/fakeurl.htm	url
https://beroniw.com/hwkOP5	url
http://193.111.117.21/R.GRE	url
a9f1e873451adc5be1e9924d876ebaf79a467ab94b3f6a4e27068206f7b52719	hash
9d7f9ba8bde293ce8fc8b703ea016eda37bdb5726fa2f86f83e70d09fcef919d	hash
82c64ef8e028f5b58f3a61719792e82bc43fe01f8a6185700ff60b71943d97f9	hash
a5f7f39121b4fdf1d9dd9c2e8cacdbae1c00cd29383eceeea2cfb3b3a03187c7	hash

Another file to check? Run a file hash reputation check.