Skip to main content

NetSupportManager RAT

Malware Family

389 indicators of compromise attributed to NetSupportManager RAT across abuse.ch threat intelligence feeds.

Domains

133

IPs

230

URLs

16

Hashes

10

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (133)IPs (230)URLs (16)Hashes (10)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
rentalsmcx.comdomain
asjkfalasfkaksflalaf.comdomain
homokiddo.comdomain
foasfjkasf.comdomain
klyvareno.comdomain
mher.clubdomain
jasjdpoekkqwda.comdomain
cloflart.comdomain
srvcmandatory.comdomain
repost.punto-viva.infodomain
daskljtitaskastvv.prodomain
boksopable.comdomain
parakoleksiyon.comdomain
lobsterrakkos.comdomain
chrm-srv.comdomain
lakestlucia.comdomain
yellowbricksj.comdomain
unwitting.fluxobase.infodomain
aosotaka.comdomain
ostlomtophamchese.comdomain
179.95.197.53ip
185.23.192.33ip
45.88.79.237ip
37.74.45.12ip
220.76.180.114ip
117.24.13.115ip
90.173.96.4ip
176.65.144.30ip
200.150.114.52ip
210.249.114.153ip
200.152.101.176ip
102.98.69.228ip
88.214.27.166ip
198.244.197.118ip
62.119.81.74ip
172.94.9.4ip
88.214.27.48ip
92.186.214.11ip
172.93.185.254ip
144.124.232.70ip
http://verifyhumanbot.com/gggs.7zurl
https://daskljtitaskastvv.pro/dsasfd555.jsurl
http://91.92.34.228/test22.txturl
http://us-addnewdevice.com/Vzj72DFgvUe1Psg5url
http://193.143.1.21/fakeurl.htmurl
https://us-addnewdevice.com/dl-callback/peevmnpz-psenf5s7-927uja3p-uey4ex9n/setup.msi/e5cdedc2f6f167f2bf343a5bb57aa7f6url
http://144.31.207.34/f.GREurl
https://cpajoliette.com/d.jsurl
https://xrplnode.dev/xrpl.phpurl
https://mysite2-1iz.pages.dev/index/url
http://google2oauth.com/google.txturl
https://xrplnode.dev/installurl
https://pub-f2969eb764264a9280dffa75e6803e93.r2.dev/setup.msiurl
http://193.143.1.21:443/fakeurl.htmurl
https://beroniw.com/hwkOP5url
http://193.111.117.21/R.GREurl
a9f1e873451adc5be1e9924d876ebaf79a467ab94b3f6a4e27068206f7b52719hash
9d7f9ba8bde293ce8fc8b703ea016eda37bdb5726fa2f86f83e70d09fcef919dhash
82c64ef8e028f5b58f3a61719792e82bc43fe01f8a6185700ff60b71943d97f9hash
a5f7f39121b4fdf1d9dd9c2e8cacdbae1c00cd29383eceeea2cfb3b3a03187c7hash

Another file to check? Run a file hash reputation check.