Fake MP4 ISO-BMFF Trojan + NetSupport RAT: PowerShell Loader Campaign via Cloudflare Infrastructure — OTX Detection Pack

---
title: PowerShell Loader Spawning NetSupport Client
id: 3f9a1c2e-7b4d-4e1a-9c55-f2a8b1d60001
status: experimental
description: Detects PowerShell processes spawning NetSupport Manager client binaries or suspicious child processes consistent with the fake-MP4 loader chain (T1059.001, T1219)
author: Security Arsenal Threat Intel
date: 2026/08/31
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_child_img:
        Image|endswith:
            - '\client32.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_child_cmd:
        CommandLine|contains:
            - 'client32'
            - 'netsupport'
    condition: selection_parent and (selection_child_img or selection_child_cmd)
falsepositives:
    - Legitimate enterprise NetSupport deployments (allowlist known admin paths)
level: high
tags:
    - attack.t1059.001
    - attack.t1219
---
title: Suspicious PowerShell Download Cradle with Encoded or Cloudflare-Staged Payload
id: 3f9a1c2e-7b4d-4e1a-9c55-f2a8b1d60002
status: experimental
description: Detects PowerShell download/extraction patterns associated with retrieving and decrypting the fake MP4 payload (T1105, T1027)
author: Security Arsenal Threat Intel
date: 2026/08/31
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'DownloadString'
            - 'DownloadFile'
            - 'Start-BitsTransfer'
    selection_cmd_crypto:
        CommandLine|contains:
            - 'FromBase64String'
            - 'AesManaged'
            - 'CreateDecryptor'
            - '-enc'
            - '-e '
    selection_cmd_mp4:
        CommandLine|contains:
            - '.mp4'
    condition: selection_img and selection_cmd_download and (selection_cmd_crypto or selection_cmd_mp4)
falsepositives:
    - Admin automation scripts downloading video assets (rare)
level: high
tags:
    - attack.t1105
    - attack.t1027
    - attack.t1059.001
---
title: NetSupport Manager Persistence via Registry Run Key
id: 3f9a1c2e-7b4d-4e1a-9c55-f2a8b1d60003
status: experimental
description: Detects registry Run key persistence pointing to NetSupport client binaries or randomly named folders under user-writable paths (T1547.001, T1219)
author: Security Arsenal Threat Intel
date: 2026/08/31
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
    selection_value:
        Details|contains:
            - 'client32'
            - '\AppData\Roaming\'
            - '\AppData\Local\'
            - '\ProgramData\'
    filter_known_good:
        Details|contains:
            - '\Program Files\NetSupport'
    condition: selection_key and selection_value and not filter_known_good
falsepositives:
    - Corporate NetSupport installs (adjust filter to your approved install path)
level: high
tags:
    - attack.t1547.001
    - attack.t1219

// Hunt: Fake MP4 / NetSupport RAT campaign — network + process telemetry (last 30 days)
let IOC_IPs = dynamic(["91.92.34.109", "91.92.240.175", "176.65.144.164"]);
let IOC_Domains = dynamic(["x2664.com", "usersecuritycheck.com", "approvalrequest-api.com", "karlenagida.com"]);
let NetEvents = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (IOC_IPs) or RemoteUrl has_any (IOC_Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let ProcEvents = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName =~ "client32.exe" or ProcessCommandLine has_any ("client32", "netsupport"))
   or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (".mp4", "FromBase64String", "CreateDecryptor") and ProcessCommandLine has_any ("DownloadString", "DownloadFile", "Invoke-WebRequest", "iwr "))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath, SHA256;
union NetEvents, ProcEvents
| sort by TimeGenerated desc

# NetSupport RAT / Fake-MP4 Campaign — Host IOC Hunt Script
# Run elevated on suspected endpoints or via EDR live response / GPO startup
$Report = @()

# 1) Check Registry Run keys for NetSupport persistence
$runKeys = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Value -match 'client32|netsupport|AppData|ProgramData'
      } | ForEach-Object {
        $Report += [pscustomobject]@{Type='RegistryRunKey'; Path=$key; Name=$_.Name; Value=$_.Value}
      }
    }
  }
}

# 2) Search user-writable paths for NetSupport client binaries
$searchPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:PROGRAMDATA")
foreach ($p in $searchPaths) {
  Get-ChildItem -Path $p -Recurse -Include 'client32.exe','HTCTL32.DLL','PCICHEK.DLL' -ErrorAction SilentlyContinue |
    ForEach-Object { $Report += [pscustomobject]@{Type='FileArtifact'; Path=$_.FullName; Name=$_.Name; Value=(Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash} }
}

# 3) Check scheduled tasks referencing suspicious binaries
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
  $actions = $_.Actions | Out-String
  if ($actions -match 'client32|powershell.*mp4|AppData.*\.exe') {
    $Report += [pscustomobject]@{Type='ScheduledTask'; Path=$_.TaskPath; Name=$_.TaskName; Value=$actions.Trim()}
  }
}

# 4) Active connections to known C2 infrastructure
$iocIPs = @('91.92.34.109','91.92.240.175','176.65.144.164')
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $iocIPs -contains $_.RemoteAddress } |
  ForEach-Object { $Report += [pscustomobject]@{Type='NetworkConnection'; Path='TCP'; Name=$_.RemoteAddress; Value=(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName} }

# 5) Recently created large MP4s in download/temp dirs (potential fake containers)
@("$env:USERPROFILE\Downloads", "$env:TEMP") | ForEach-Object {
  Get-ChildItem $_ -Filter '*.mp4' -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 5MB -and $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    ForEach-Object { $Report += [pscustomobject]@{Type='SuspiciousMP4'; Path=$_.FullName; Name=$_.Name; Value="$([math]::Round($_.Length/1MB,1)) MB - verify with ffprobe"} }
}

$Report | Format-Table -AutoSize
if ($Report.Count -gt 0) { $Report | Export-Csv ".\NetSupport_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation; Write-Host "[!] $($Report.Count) hits - exported CSV" -ForegroundColor Red } else { Write-Host "[+] Clean" -ForegroundColor Green }