NetSupport RAT Hidden in Fake MP4 Containers: PowerShell Loader + ISO-BMFF uuid Box Steganography — OTX Detection Pack

AlienVault OTX researchers, building on analysis originally published by Censys, have documented an active delivery campaign in which threat actors conceal encrypted NetSupport Manager remote access trojan (RAT) payloads inside fake MP4 video files. The files pass superficial file-type validation — they carry valid ISO Base Media File Format (ISO-BMFF) headers — but instead of playable video, roughly 6.5 MB of encrypted payload data is stashed inside uuid extension boxes of the container. Delivery is initiated by PowerShell loaders pulled from Cloudflare-fronted infrastructure, giving the operation reputable-CDN cover that defeats naive domain-reputation controls.

NetSupport Manager is a legitimate commercial remote administration tool that has been abused by criminal operators for years (notably in SocGholish/FakeUpdates and PhantomLoader ecosystems). Once installed, it grants full interactive control: screen viewing, file transfer, command execution, and proxying — everything an operator needs for hands-on intrusion, data theft, or ransomware staging.

Threat Summary

This pulse describes a single coherent infection chain with three defining characteristics:

1. Steganographic-style container abuse. The payload is not appended sloppily to a file; it is embedded inside a structurally valid MP4 using the ISO-BMFF uuid box mechanism, which is designed for vendor-specific extensions. Basic file checks, magic-byte scanners, and many email/web gateways that only validate the header will classify the file as a benign video.
2. Script-driven delivery. A PowerShell loader retrieves the fake MP4 (e.g., tzast.mp4, 333.mp4, 55555555.mp4), extracts the encrypted blob from the uuid boxes, decrypts it in memory or to disk, and installs the NetSupport client.
3. Cloudflare-fronted C2/staging. Staging domains such as approvalrequest-api.com and usersecuritycheck.com sit behind Cloudflare, obscuring origin infrastructure and blending malicious downloads with legitimate HTTPS traffic.

Objective: covert establishment of persistent remote access on enterprise endpoints. NetSupport RAT footholds are routinely monetized via access brokerage or used directly for credential theft, lateral movement, and follow-on payload deployment including ransomware.

Threat Actor / Malware Profile: NetSupport Manager RAT (Abused)

• Type: Legitimate remote administration tool weaponized as a RAT.
• Distribution: Fake MP4 files with encrypted payloads in ISO-BMFF uuid boxes; retrieved and executed by PowerShell loaders; staged from Cloudflare-fronted domains and bare IP hosting (89.34.90.111).
• Payload behavior: On execution, the NetSupport client (client32.exe in default installs) installs to %APPDATA% or %ProgramFiles%-style paths, registers the victim with operator infrastructure, and awaits interactive commands (desktop control, file transfer, shell execution, registry editing).
• C2 communication: NetSupport clients beacon over TCP (default port 5405 historically, frequently customized) to operator gateways; in this campaign, supporting infrastructure includes domains such as x2664.com and karlenagida.com. Traffic can masquerade as ordinary HTTPS where CDNs are abused.
• Persistence: Common patterns include Run-key registry entries (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), Startup folder shortcuts, and scheduled tasks launching the client executable.
• Anti-analysis: Payload is encrypted and only decrypted by the loader at runtime; container-based concealment defeats static file inspection; Cloudflare fronting defeats IP/domain blocklists based on hosting reputation. The random-looking filenames (55555555.mp4, tzast.mp4) also frustrate name-based detection.
• Attribution: No named actor in this pulse (TLP:WHITE, author AlienVault). The TTPs overlap with known NetSupport distribution ecosystems such as FakeUpdates/SocGholish and PhantomLoader operators.

IOC Analysis

The pulse contains 63 indicators, of which the exposed sample includes:

• Domains (4): x2664.com, usersecuritycheck.com, approvalrequest-api.com, karlenagida.com — treat as staging/C2. Note the generic "security/approval" naming convention designed to look benign in proxy logs.
• URLs (4): direct download paths including http://89.34.90.111/tzast.mp4 and http://approvalrequest-api.com/333.mp4, /55555555.mp4 — plaintext HTTP delivery of the fake MP4 containers.
• Bare IP hosting: 89.34.90.111 serving .mp4 over HTTP — a strong anomaly signal on its own.

Operationalization guidance for SOC teams:

1. Ingest domains and IPs into DNS sinkhole, proxy/SWG block, and firewall egress deny lists immediately.
2. Add URL patterns (*.mp4 fetched over HTTP from non-CDN origins, or any MP4 download initiated by a script interpreter) to proxy alerting.
3. Retro-hunt proxy, DNS, and EDR telemetry for the past 30–90 days against all 63 indicators — a single hit on approvalrequest-api.com is a full investigation trigger, not a low-severity event.
4. For any downloaded MP4, inspect structure: ISO-BMFF parsers (e.g., mp4dump from Bento4, Python pymp4, or ExifTool) will reveal abnormally large uuid boxes — a near-certain malicious indicator in an enterprise context.

Detection Engineering

---
title: PowerShell Download of Suspect MP4 Container
description: Detects PowerShell retrieving .mp4 files via web request cmdlets, consistent with the fake-MP4 NetSupport loader chain observed in OTX pulse activity.
id: 7f3a1b2c-4d5e-4f6a-8b9c-0d1e2f3a4b5c
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'wget '
      - 'curl '
      - 'DownloadFile'
      - 'DownloadString'
      - 'Start-BitsTransfer'
  selection_mp4:
    CommandLine|contains:
      - '.mp4'
  condition: selection_img and selection_cli and selection_mp4
falsepositives:
  - Administrators downloading legitimate video content via script (rare)
level: high
tags:
  - attack.t1105
  - attack.t1059.001
  - attack.t1027
date: 2026/10/18
---
title: NetSupport RAT Client Execution from User Profile Paths
description: Detects execution of NetSupport client components (client32.exe) or renamed binaries from AppData/Roaming/Temp, a common install pattern for weaponized NetSupport Manager deployments.
id: 8a4b2c3d-5e6f-4a7b-9c0d-1e2f3a4b5c6d
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\client32.exe'
      - '\pcictlui.exe'
      - '\remotelyanywhere.exe'
  selection_path:
    Image|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  condition: selection_name or selection_path
falsepositives:
  - Legitimate corporate NetSupport deployments typically install under Program Files with managed paths; verify against software inventory
level: high
tags:
  - attack.t1219
  - attack.t1105
date: 2026/10/18
---
title: Persistence via Run Key for Remote Administration Tool
description: Detects registry Run-key persistence entries pointing to executables in user-writable directories, consistent with NetSupport RAT persistence following fake-MP4 payload decryption.
id: 9b5c3d4e-6f7a-4b8c-0d1e-2f3a4b5c6d7e
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\Temp\'
      - 'client32'
  condition: selection_key and selection_value
falsepositives:
  - Legitimate user-space updaters (OneDrive, Teams) — whitelist known-good paths
level: medium
tags:
  - attack.t1547.001
  - attack.t1219
date: 2026/10/18

// Hunt: Fake MP4 NetSupport delivery chain — process, network, and file telemetry
// Lookback: 30 days. Covers PowerShell MP4 downloads, C2 domains, and NetSupport client artifacts.
let lookback = 30d;
let malicious_domains = dynamic(["x2664.com", "usersecuritycheck.com", "approvalrequest-api.com", "karlenagida.com"]);
let malicious_ips = dynamic(["89.34.90.111"]);
// 1. Network connections to known staging/C2 infrastructure
let net_hits = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (malicious_domains) or RemoteIP in (malicious_ips)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// 2. PowerShell processes downloading .mp4 payloads
let ps_downloads = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Invoke-WebRequest", "iwr", "wget", "curl", "DownloadFile", "Start-BitsTransfer")
  and ProcessCommandLine has ".mp4"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// 3. NetSupport client execution from suspicious paths
let rat_exec = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName =~ "client32.exe"
   or (ProcessCommandLine has_any ("\\AppData\\", "\\Users\\Public\\") and FileName has "client")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine;
union net_hits, ps_downloads, rat_exec
| sort by TimeGenerated desc

# Fake-MP4 NetSupport RAT endpoint hunt — Security Arsenal
# Run via EDR live response, GPO startup script, or your RMM across the fleet.
# Checks: persistence artifacts, NetSupport files, recent MP4 drops, active C2 connections.

$report = [ordered]@{ Host = $env:COMPUTERNAME; Timestamp = (Get-Date).ToString('u'); Findings = @() }

# 1. Run-key persistence pointing to user-writable paths
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'AppData|Users\\Public|Temp|client32' -and $_.Name -notmatch '^PS'
            } | ForEach-Object { $report.Findings += "PERSISTENCE: $key -> $($_.Name) = $($_.Value)" }
        }
    }
}

# 2. NetSupport client binaries in suspicious locations
$searchPaths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\Users\Public", "$env:ProgramData")
foreach ($p in $searchPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -Include client32.exe,pcictlui.exe -ErrorAction SilentlyContinue |
            ForEach-Object { $report.Findings += "BINARY: $($_.FullName) (Created: $($_.CreationTime))" }
    }
}

# 3. Large MP4 files (potential fake containers, >4MB) modified in last 30 days
foreach ($p in @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\Users\Public\Downloads")) {
    if (Test-Path $p) {
        Get-ChildItem $p -Filter *.mp4 -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -gt 4MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            ForEach-Object { $report.Findings += "MP4: $($_.FullName) ($([math]::Round($_.Length/1MB,1)) MB)" }
    }
}

# 4. Active connections to known C2 / staging infrastructure
$c2 = @('89.34.90.111')
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $c2 -contains $_.RemoteAddress } |
    ForEach-Object { $report.Findings += "C2-CONN: $($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess)" }

# 5. DNS cache evidence of malicious domains
$domains = 'x2664.com','usersecuritycheck.com','approvalrequest-api.com','karlenagida.com'
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Entry; $domains | Where-Object { $n -like "*$_*" }
} | ForEach-Object { $report.Findings += "DNS-CACHE: $($_.Entry) -> $($_.Data)" }

if ($report.Findings.Count -gt 0) { $report | ConvertTo-Json -Depth 4 } else { "[$env:COMPUTERNAME] CLEAN" }

Response Priorities

Immediate (0–4 hours):

• Block x2664.com, usersecuritycheck.com, approvalrequest-api.com, karlenagida.com, and 89.34.90.111 at DNS, proxy, and egress firewall. Ingest the full 63-indicator set from the OTX pulse into your TIP and push to all enforcement points.
• Alert on any HTTP (non-TLS) download of .mp4 files from non-CDN origins — legitimate video is almost never fetched over plaintext HTTP from bare IPs in 2026.
• Run the KQL hunt and PowerShell sweep across the fleet; any hit on NetSupport binaries outside approved software inventory is a confirmed compromise until proven otherwise.

24 hours:

• For any endpoint with confirmed NetSupport execution, treat all credentials used on that host as compromised — NetSupport gives operators interactive access, enabling keylogging, browser credential extraction, and token theft. Force resets and revoke sessions/refresh tokens for affected users.
• Review lateral movement from confirmed hosts: NetSupport operators pivot quickly. Check for SMB/RDP/WinRM connections initiated from the victim in the window after initial execution.
• Acquire memory and triage images of confirmed hosts before remediation; the decrypted payload and operator commands may only exist in memory.

1 week:

• Deploy application control (WDAC/AppLocker) rules blocking client32.exe and NetSupport digital signatures where the product is not an approved corporate tool — RAT-by-legitimate-software is a top-5 initial access technique.
• Harden PowerShell: enable Script Block Logging and Module Logging fleet-wide, enforce Constrained Language Mode where feasible, and block child process spawning from Office and script interpreters.
• Add email/web gateway content inspection that parses MP4 container structure rather than trusting magic bytes — flag files whose payload mass sits in uuid boxes.
• Restrict outbound traffic to Cloudflare-fronted unknown domains via category-based filtering and TLS inspection where policy permits.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub