Analysis of NetClient RAT

TrueIndian · 2017-09-28T08:16:45.000Z

contacted domain and function of plugin files:
https://pastebin.com/68Xpwc3s

3 components from plugin directory:
password-protected netclient
7z console
cmd/batch script

C2:
/185.213.208.240/fakeurl.htm

initial evidence of plugin url came from debugging the malware and looking under loadlibraryA

Singed By COMODO >:(

Neither the malware nor its domains were detected by avast.Reported to labs.

TrueIndian · 2017-09-28T08:17:32.000Z

Last set of screenshots…typo error:
/exortwex.com/wp-content/plugins/Zdi8ioQopO33 this is the netsupport download link.Its a 7z archive

Announcements