MovieReaper Torrent Supply-Chain Attack + Fake MP4 NetSupport RAT Loader: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious PowerShell Download and Execution of MP4-Lure Payload
description: Detects PowerShell retrieving .mp4 files over HTTP and/or spawning from Office/script contexts consistent with the fake-MP4 NetSupport loader chain
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps_download:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'DownloadString'
            - '.mp4'
    selection_ps_webclient:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Net.WebClient'
            - 'http'
        CommandLine|contains:
            - '.mp4'
            - 'tzast'
            - '333.mp4'
            - '55555555'
    condition: 1 of selection_ps_*
fields:
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Rare legitimate media pipeline automation
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
date: 2026/10/17
---
title: NetSupport Manager RAT Client Installation or Execution
description: Detects installation or execution of NetSupport Manager client components (client32.exe) outside expected IT deployment paths, consistent with fake-MP4 delivered RAT
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://censys.com/blog/fake-mp4-file-carries-malicious-payload/
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary:
        Image|endswith:
            - '\client32.exe'
            - '\pcictlui.exe'
            - '\nsm.exe'
    selection_path:
        Image|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Downloads\'
            - '\Public\'
    selection_service_install:
        Image|endswith:
            - '\sc.exe'
        CommandLine|contains|all:
            - 'create'
            - 'netsupport'
    condition: (selection_binary and selection_path) or selection_service_install
fields:
    - Image
    - CommandLine
    - ParentImage
falsepositives:
    - Legitimate NetSupport deployments by IT (tune with known deployment paths)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
    - attack.t1543.003
date: 2026/10/17
---
title: MovieReaper Blockchain C2 or UAC Bypass Behavior
description: Detects egress to Solana RPC endpoints from non-wallet processes and silent elevation patterns consistent with MovieReaper UAC bypass and blockchain dead-drop C2
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.ru/moviereaper-malware-torrent-odyssey-solana/117109
logsource:
    category: network_connection
    product: windows
detection:
    selection_solana_rpc:
        DestinationHostname|contains:
            - 'mainnet-beta.solana.com'
            - 'solana-mainnet'
            - 'rpc.ankr.com'
            - 'deadhub.org'
    filter_known_wallets:
        Image|contains:
            - '\Phantom\'
            - '\Solflare\'
    condition: selection_solana_rpc and not filter_known_wallets
fields:
    - Image
    - DestinationHostname
    - DestinationIp
falsepositives:
    - Development workstations using Solana SDKs
level: medium
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.privilege_escalation
    - attack.t1548.002
date: 2026/10/17

// MovieReaper + Fake-MP4 NetSupport chain hunt — Microsoft Sentinel
// Part 1: Network indicators from both pulses
let MovieReaperIoCs = dynamic(["deadhub.org"]);
let NetSupportIoCs = dynamic(["x2664.com", "usersecuritycheck.com", "approvalrequest-api.com", "karlenagida.com", "89.34.90.111"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in (MovieReaperIoCs) or RemoteUrl in (NetSupportIoCs)
    or RemoteIP in (NetSupportIoCs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// Part 2: PowerShell retrieving .mp4 over HTTP (fake-MP4 loader behavior)
let Mp4Loader = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has_all ("http", ".mp4")
    or ProcessCommandLine has_any ("tzast.mp4", "333.mp4", "55555555.mp4")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Part 3: NetSupport client execution from user-writable paths
let NetSupportExec = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "client32.exe"
| where FolderPath has_any ("\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\Public\\")
| project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, SHA256;
union NetworkHits, Mp4Loader, NetSupportExec
| sort by TimeGenerated desc

<#
.SYNOPSIS
    MovieReaper + Fake-MP4 NetSupport RAT endpoint hunt script
.DESCRIPTION
    Checks for NetSupport RAT artifacts, MovieReaper loader hashes/persistence,
    suspicious MP4 containers with oversized uuid boxes, and C2 connections.
    Run elevated on suspect endpoints or deploy via EDR live-response.
#>

$report = @()

# 1) NetSupport Manager client artifacts
$nsPaths = @("$env:ProgramFiles\NetSupport", "${env:ProgramFiles(x86)}\NetSupport",
             "$env:ProgramData\NetSupport", "$env:APPDATA\NetSupport",
             "$env:LOCALAPPDATA\NetSupport")
foreach ($p in $nsPaths) {
    if (Test-Path $p) {
        $report += [PSCustomObject]@{Check='NetSupportPath'; Finding="Found: $p"; Severity='High'}
    }
}
Get-Process -Name 'client32','pcictlui','nsm' -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [PSCustomObject]@{Check='NetSupportProcess'; Finding="$($_.Name) PID $($_.Id) Path: $($_.Path)"; Severity='High'}
}
Get-Service | Where-Object { $_.Name -match 'netsupport|client32' -or $_.DisplayName -match 'NetSupport' } | ForEach-Object {
    $report += [PSCustomObject]@{Check='NetSupportService'; Finding="$($_.Name) - $($_.Status)"; Severity='High'}
}

# 2) MovieReaper loader hashes (MD5 from OTX pulse)
$hashes = @('4843f9fafcae492f11e2d4d33dbb4cdd','5310cabae3fbe6db8742849b588093f9',
            'a0b13781edd7cfdab13d79afff3c83c1','70060341caf3338697a7ddfe0fb62875',
            'ad4643eea15ac286fa47d1131f9ef756','d0b967571ac8a3863c7f324bf5bde99c')
foreach ($dir in @("$env:USERPROFILE\Downloads","$env:TEMP","$env:PUBLIC\Downloads")) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($md5 -and ($hashes -contains $md5.ToLower())) {
                $report += [PSCustomObject]@{Check='MovieReaperHash'; Finding="$($_.FullName) MD5 $md5"; Severity='Critical'}
            }
        }
    }
}

# 3) Persistence: Run keys and scheduled tasks referencing media/torrent themes
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    (Get-ItemProperty $rk -ErrorAction SilentlyContinue).PSObject.Properties |
        Where-Object { $_.Value -match 'movie|torrent|odyssey|update.*\.mp4|client32' } |
        ForEach-Object { $report += [PSCustomObject]@{Check='RunKeyPersistence'; Finding="$rk -> $($_.Name) = $($_.Value)"; Severity='High'} }
}
Get-ScheduledTask | Where-Object { ($_.Actions.Execute + $_.Actions.Arguments) -match 'powershell.*http|\.mp4|client32' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='ScheduledTaskPersistence'; Finding="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity='High'} }

# 4) Suspicious MP4 files: valid container, oversized uuid box (encrypted payload)
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.mp4 -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $bytes = [System.IO.File]::ReadAllBytes($_.FullName)[0..([Math]::Min(64, $_.Length-1))]
    $header = [System.Text.Encoding]::ASCII.GetString($bytes)
    if ($header -match 'ftyp' -and $_.Length -gt 5MB -and $header -match 'uuid') {
        $report += [PSCustomObject]@{Check='SuspiciousMp4UuidBox'; Finding="$($_.FullName) ($([math]::Round($_.Length/1MB,1)) MB) — possible uuid-box payload"; Severity='High'}
    }
}

# 5) Active/historical C2 connections
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -eq '89.34.90.111' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='C2Connection'; Finding="Connection to 89.34.90.111:$($_.RemotePort) PID $($_.OwningProcess)"; Severity='Critical'} }
Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $_.Entry -match 'deadhub\.org|x2664\.com|usersecuritycheck\.com|approvalrequest-api\.com|karlenagida\.com' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='C2DnsCache'; Finding="$($_.Entry) -> $($_.Data)"; Severity='Critical'} }

if ($report.Count -eq 0) { Write-Host "[+] No MovieReaper / NetSupport indicators found on $env:COMPUTERNAME" -ForegroundColor Green }
else { $report | Format-Table -AutoSize; $report | Export-Csv ".\hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }