# NetSupport Loader multi-stage obfuscated PowerShell chain (decimal array, AES-ECB, GZIP) deobfuscated with CyberChef

> Embee Research documented a NetSupport Loader sample (SHA256 befc7ebb...bfab, from Malware Bazaar) built from three chained scripts that hide the payload behind decimal-array encoding with subtraction constants, AES-ECB encryption and GZIP compression. Stage 3 reveals the Net.Webclient string, indicating download capability for the NetSupport RAT, which is a legitimate remote-administration tool widely abused by threat actors.

- **Published:** 2026-10-30T08:20:04Z
- **Last reviewed:** 2026-10-30T08:20:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4810
- **ID:** TL-2026-4810
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Embee Research (published 2024-02-26) walks through deobfuscating a NetSupport Loader sample obtained from Malware Bazaar (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab). The sample consists of three separate scripts that are peeled apart with a 22-operation CyberChef recipe using Fork/Merge flow control and registers ($R0-$R3) to hold extracted keys and constants.

Stage 1 is a large decimal integer array inside the script. Each value has the constant 787 subtracted and is converted to an ASCII character, which yields the Stage 2 PowerShell script. Stage 2 contains a Base64 blob: a 44-character Base64 string (extracted by regex) is the AES key, the first 16 bytes of the decoded blob are used as the IV, the data is decrypted with AES in ECB mode and then GZIP-decompressed; trailing null bytes are stripped with the regex \0+$. The result is the Stage 3 PowerShell script.

Stage 3 uses four separate decimal arrays obfuscated with the same subtraction method, with the constant 4274. Decoding reveals strings such as Net.Webclient, which indicates the script performs network retrieval of the next component (the NetSupport RAT payload). The article lists no C2 domains, IPs or URLs, so network indicators are not available from this source.

NetSupport Manager is a legitimate remote administration tool that has been abused by threat actors since at least 2020 (Red Canary ranked it #4 in its 2025 Threat Detection Report). Public reporting on the wider family describes delivery through fake updates, SocGholish, loaders such as GHOSTPULSE and, in 2025, malicious copy-and-paste (ClickFix-style) lures; persistence through Run keys, Startup shortcuts and scheduled tasks; and client32.exe frequently executing from ProgramData, Downloads or Roaming rather than Program Files. These family-level behaviors are context from other sources and were not confirmed for this specific sample by the Embee write-up. Defenders should focus on detecting the obfuscation primitives (large decimal arrays with arithmetic decoding, AES/GZIP in PowerShell, Net.Webclient), unusual client32.exe execution, and unsanctioned RMM tooling.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1219 Remote Access Tools
- T1547.001 Registry Run Keys / Startup Folder

## Sources

- [Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples](https://www.embeeresearch.io/advanced-cyberchef-operations-netsupport/)
- [MalwareBazaar sample befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab](https://bazaar.abuse.ch/sample/befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab/)
- [Fake Software Update Abuses NetSupport Remote Access Tool (Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/fake-software-update-abuses-netsupport-remote-access-tool)
- [NetSupport RAT Infections on the Rise (The Hacker News)](https://thehackernews.com/2023/11/netsupport-rat-infections-on-rise.html)
- [NetSupport Manager - Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/netsupport-manager/)
- [Splunk Analytics Story: NetSupport RMM Tool Abuse](https://research.splunk.com/stories/netsupport_rmm_tool_abuse/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4810