# Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)

> A three-stage NetSupport RAT loader (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab) uses decimal-array subtraction decoding, AES-ECB-encrypted/base64/GZIP-packed PowerShell, and a second decimal-array stage to progressively unpack and launch a portable NetSupport Manager RAT installation on the victim host. The loader chain matches the broader 2024-2025 NetSupport RAT resurgence tracked by Talos, Red Canary, and Team Cymru, in which SmartApeSG/FakeUpdates-style fake-browser-update and ClickFix lures drop the same client32.exe payload against rotating C2 infrastructure.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1487
- **ID:** TL-2026-1487
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SmartApeSG
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat documents a multi-stage NetSupport RAT (NetSupportManager RAT) loader analyzed via a 22-operation CyberChef recipe by embee-research (2024-02-26) against a sample retrieved from Malware Bazaar (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab).

The loader executes in three obfuscation stages. Stage 1 embeds the next-stage PowerShell script as a large decimal integer array; each element has a fixed value (787) subtracted from it before being converted from decimal to an ASCII character code, reassembling a Stage 2 PowerShell script. Stage 2 contains an AES key (a 44-character base64 string embedded in single quotes) and a base64-encoded ciphertext blob. After base64-decoding the blob, the first 16 bytes are extracted and used as the AES initialization vector; the remainder is decrypted with AES in ECB mode, trailing null bytes are stripped, and the result is GZIP-decompressed to reveal Stage 3. Stage 3 repeats the decimal-array/subtraction technique from Stage 1 but with a different subtraction constant (4274) applied across four separate arrays, ultimately reconstructing PowerShell logic that invokes Net.Webclient to retrieve further payloads and resolve command-and-control URLs.

The end state of this loader family, consistent across the broader 2023-2025 NetSupport RAT campaign tracked independently by Cisco Talos, VMware, Red Canary, Team Cymru, ThreatDown, and OpenText, is deployment of a portable, unlicensed copy of the legitimate NetSupport Manager remote-administration tool (client32.exe) with attacker-controlled configuration pointed at rotating C2 infrastructure. NetSupport Manager is a 30-year-old commercial remote-support product that is trivially repurposed as a full-featured RAT: operators can lock the victim's mouse/keyboard, execute arbitrary commands including shutdown/reboot, and capture screen, audio, and video for surveillance. Persistence is established at user level via an HKCU Run-key registry entry and/or a .url shortcut in the Startup folder, with some variants additionally using scheduled tasks. Delivery vectors documented across the wider campaign include malicious/compromised-site JavaScript stagers (SmartApeSG/FakeUpdates fake browser-update lures), ClickFix-style fake CAPTCHA pages that trick users into pasting and running a PowerShell one-liner (T1204.004, the most prevalent 2025 delivery vector per Red Canary), and secondary-payload delivery from SocGholish, Qbot, and Scarlet Goldfinch infections. C2 infrastructure observed in the related SmartApeSG-to-NetSupport RAT infection chain is hosted primarily on Moldovan MivoCloud IP space with NetSupport RAT client traffic on TCP/443, TCP/447 and TCP/2552, and separate RDP/WinRM-exposed management hosts identified by X.509 certificate common names (e.g., CN=MATRACHEDICIDGA matching management host 5.181.157.69). A large, rapidly rotated pool of C2 domains (dozens of randomly-generated .cn/.icu/.xyz/.top/.com/.net names) is used to hinder tracking and takedown, alongside legitimate-service abuse (fex.net cloud storage, an exploit.im Jabber server) and brand-impersonation sites for trading/financial lures.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1072 Software Deployment Tools
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1036 Masquerading
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1056 Input Capture
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1529 System Shutdown/Reboot

## Sources

- [Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples](https://www.embeeresearch.io/advanced-cyberchef-operations-netsupport/)
- [Detecting evolving threats: NetSupport RAT campaign](https://blog.talosintelligence.com/detecting-evolving-threats-netsupport-rat/)
- [NetSupport Manager | Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/netsupport-manager/)
- [Tracing the Path from SmartApeSG to NetSupport RAT](https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat)
- [FakeSG enters the 'FakeUpdates' arena to deliver NetSupport RAT](https://www.threatdown.com/blog/fakesg-enters-the-fakeupdates-arena-to-deliver-netsupport-rat/)
- [NetSupport Remote Access Trojan (RAT) delivered through fake browser updates by SocGholish threat actors](https://blogs.opentext.com/netsupport-remote-access-trojan-rat-delivered-through-fake-browser-updates-by-socgholish-threat-actors/)
- [NetSupport RAT: The RAT King Returns](https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html)
- [NetSupportManager RAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat)
- [Gotta Catch 'Em All | Understanding the NetSupport RAT Campaigns Hiding Behind Pokemon Lures](https://www.sentinelone.com/blog/gotta-catch-em-all-understanding-the-netsupport-rat-campaigns-hiding-behind-pokemon-lures/)
- [NetSupport RAT: Why Legitimate Tools Are as Damaging as Malware](https://www.darktrace.com/blog/netsupport-rat-how-legitimate-tools-can-be-as-damaging-as-malware)
- [How NetSupport RAT Abuses Legitimate Remote Admin Tool](https://www.picussecurity.com/resource/blog/how-netsupport-rat-abuses-legitimate-remote-admin-tool)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1487