A crew is installing the NetSupport Manager remote access tool through VBS scripts whose decoys imitate freight rate confirmations and contracts of carriage.
One of the crew's delivery servers sits in a MivoCloud /24 that also hosts FlyMail, a Russian-language email and Telegram outreach platform built to be resold as a service. Matching domain purchases, a shared NetSupport server and a shared DNS name tie the two operations together.
Snoopy Triage, Tuxxin's threat analysis platform, decoded the chain and mapped the servers.
Status on November 4, 2026, 13:50 UTC:
- The MivoCloud delivery server came back on November 3 under a new domain with the same NetSupport package. It went offline again at 00:30 UTC on November 4, about 10 hours after our follow-up report.
- The Kyonix delivery server is still online. It serves the kit on
docsforsend[.]com, with a new stage2.js build since November 3. - Both command-and-control (C2) servers still accept connections on port 443.
- The FlyMail login on
194.180.191[.]209no longer loads.coblla[.]comstill serves the FlyMail login, now behind Cloudflare.
How the sample surfaced
On October 29, 2026, @malwrhunterteam posted the delivery domain checkyoursecurityfast[.]com. @smica83 followed with a related script, "Document 9523_0951.vbs", uploaded to MalwareBazaar. Earlier, @skocherhan had tagged nairawaterfall[.]com on the MivoCloud server and two domains on Kyonix 150.241.66[.]223 as NetSupport on October 23, and four more domains, including gosidefastandpure[.]com, on October 24.
The infection chain
We have not seen the message that carries the first stage. The sample reached MalwareBazaar as "Document 9523_0951.vbs", a document-style name on a script file, and both decoys are freight paperwork, which points to lures sent to carriers and brokers. The sender, subject lines and delivery channel are unconfirmed. Mail filters can still act on the file type: a .vbs file named like a document.
1. A VBS posing as a WebView2 check
The script calls itself a "Microsoft Edge WebView2 Runtime Compatibility Check" and writes a WMI system profile to %TEMP%\EdgeWebView2Check.log. It continues only on Windows 10 or later (build 10240+) with at least 200 MB of free disk space.
It decodes the second stage with a custom base64 alphabet, DTHgzjiA9aReU7OoxqwySLsPQ_NvJpmFKWkIE8421C0clZGu3Mh-BXfbYnrdV65t. It then subtracts 71 from each byte. The result goes to a random .vbs file in %TEMP%, runs under cscript and is deleted.
2. A VBS downloader
The second script stores its configuration in a process environment variable as a pipe-separated list: install folder names, the client's disguise name and the delivery URLs. It downloads stage2.js and runs it as JScript:
hxxps://cdn.checkyoursecurityfast[.]com/stage2.js?id=8d67e7c2&env=X_FE39CB
3. stage2.js, a fake jQuery 3.6.0
stage2.js opens with a copy of jQuery 3.6.0 and hides its dropper in a function named _internalCacheInit. In order, it:
- Reports progress to
/track?id=<victim id>&stage=stage2:running, thenfiles:ok, thenpersist:ok&pcname=<computer name>. - Opens a decoy PDF through
rundll32 url.dll,FileProtocolHandler. - Downloads
/assets/pkg/package.tar.gzwith curl.exe and unpacks it with tar into%APPDATA%\UpdateHelper, with copies in%LOCALAPPDATA%\Microsoft\Edge\ComponentUpdateand a hidden%LOCALAPPDATA%\Microsoft\EdgeUpdate\backup. - Installs
handler.batandwatchdog.vbs, a 60-second restart loop, in%LOCALAPPDATA%\Microsoft\EdgeUpdate\runtime. - Persists through the HKCU Run value
MicrosoftEdgeSpellCheck, plusEdgeUpdate.vbsandMicrosoftEdgeWebView.lnkin the Startup folder.
Each download of stage2.js without an id parameter carries a fresh 8-character victim ID. The backend mints an ID per download and tracks each victim's progress through the /track beacons.
4. The NetSupport client
The package holds a standard NetSupport Manager client. client32.exe is renamed msedgewebview.exe and runs silently. The license file in the package we recovered from the MivoCloud server carries licensee GJHYUT534 and serial NSM280812, a license common in cracked NetSupport builds. The license file on the Kyonix server (fetched November 4) is byte-identical, so both builds carry licensee GJHYUT534 and serial NSM280812.
Both client32.ini files we recovered were made with a tool named NetSupportConfigBuilder. Each records the builder's folder path, which makes the paths below useful fingerprints for grouping builds. The Windows user names in them (antim, Administrator) are build-machine accounts and identify no one.
| Delivery server | C2 (GatewayAddress) | GSK | Builder path |
|---|---|---|---|
MivoCloud 194.180.191[.]245
|
91.202.233[.]57:443 |
GD:L?PBDDG9I<BAAFP<C@H |
C:\Users\antim\OneDrive\Desktop\NetSupportConfigBuilder |
Kyonix 2.27.63[.]78
|
192.162.199[.]79:443 |
FH;G@FEKHA;C>IDGHN=MBO |
C:\Users\Administrator\Desktop\NetSupportConfigBuilder |
The decoy documents
Both delivery servers serve the same decoy, /assets/docs/document.pdf: a genuine-looking US freight rate confirmation from February 2024, signed through DocuSign. On October 22, 2026, the MivoCloud server added eudoc.pdf, a Czech contract of carriage between a freight forwarder and a Croatian haulier dated September 18, 2026. The second decoy shows the crew widening from US carriers to European ones.
Both PDFs name real companies and people. We withhold those names and keep the files out of public distribution.
Remote access to carrier and broker systems is a known route to cargo theft, where loads are booked and diverted under a legitimate carrier's name.
Delivery infrastructure
Both delivery servers run Apache on Debian. Port 80 serves the Debian default page for every hostname, and port 443 serves the kit. Each kit domain gets cdn., download. or downloads. hostnames, and /assets/pkg/ is an open directory listing.
MivoCloud server 194.180.191[.]245 (AS39798)
| Domain | Registrar | First seen on the server |
|---|---|---|
pietreez[.]net |
Namecheap (aged, 2026-05) | 2026-08-24 |
heartnex[.]org |
Namecheap (aged, 2025-05) | 2026-08-25 |
odenselam[.]com |
Namecheap | 2026-08-26 |
nairawaterfall[.]com |
NICENIC, 2026-10-07 | 2026-10-08 |
checkyoursecurityfast[.]com |
NICENIC, 2026-10-27 | 2026-10-27 |
verifyconnectionsecurely[.]com |
NICENIC, 2026-11-02 | 2026-11-03 |
A Haulmer store subdomain, joseriquelme-tienda1.haulmer[.]com, also pointed here from September 1 to 12, 2026, and has since returned to Haulmer. The package on this server is dated October 8, 2026.
Kyonix server 2.27.63[.]78 (AS210457)
| Domain | Registrar | Active |
|---|---|---|
transunionbiba[.]lat |
.lat registry, 2026-10-19 | October 19 to 26, 2026 (now NXDOMAIN) |
ajtrucking[.]lat |
.lat registry, 2026-10-28 | October 28 to November 2, 2026 |
docsforsend[.]com |
NameSilo, 2026-11-02 10:39 UTC | Since November 2, 2026 |
The NetSupport files on this server date from September 23, 2026, and the package from September 28, so it carries the older of the two builds. The transunionbiba[.]lat builds used hardcoded URLs, the install folder %APPDATA%\DriverWebUpdate and the client name updaterdriveon.exe. Later builds read their names from the stage 2 environment variable. All builds share the same persistence names.
A third Kyonix address, 150.241.66[.]223, hosted sakenlogistics[.]com and youlovemybiba[.]com (NameSilo, September 2026). Neither answers today.
The November 2 domain rotation
On November 2, 2026, the crew replaced ajtrucking[.]lat with docsforsend[.]com on the same Kyonix server:
| Time (UTC) | Event |
|---|---|
| 10:39 |
docsforsend[.]com registered at NameSilo |
| About 10:43 | Zone added to Cloudflare DNS (Cloudflare edge certificates logged) |
| About 12:12 | Let's Encrypt certificate for the apex, cdn. and download. issued on the Kyonix server |
| By 12:25 |
ajtrucking[.]lat removed from the server; its kit paths return 404 |
| 12:40 | Snoopy Triage detects the kit on docsforsend[.]com
|
ajtrucking[.]lat still resolves to the Kyonix server, and since November 3 its /assets/pkg/ listing answers again.
The kit is unchanged. The new stage2.js differs from the ajtrucking[.]lat copy only in the victim ID and the decoy URL, and the new client32.ini still points to 192.162.199[.]79:443 with the same GSK and builder path. Spamhaus listed docsforsend[.]com as botnet C2 the same day.
Our abuse report for ajtrucking[.]lat went to Kyonix on November 1. The server still serves the kit under the new name. The rotation was the crew's move, and we found no sign that Kyonix acted.
Update: November 3 and 4
The MivoCloud server returned under a new name. verifyconnectionsecurely[.]com was registered at NICENIC, the crew's usual registrar, on November 2 at 18:42 UTC, while the MivoCloud server was dark. From November 3, 12:17 UTC it resolved to 194.180.191[.]245 with the apex, cdn. and downloads. hostnames. /track answered 204 and /assets/pkg/ was again an open listing. Its package.tar.gz is byte-identical to the checkyoursecurityfast[.]com package (SHA-256 60c8fa7f...), and its client32.ini still points to 91.202.233[.]57:443. The November 2 outage was therefore a pause. We sent MivoCloud a follow-up report on November 3 at 14:31 UTC. The server stopped answering on November 4 at 00:30 UTC and has stayed down; the domain still resolves to it. MivoCloud has not replied.
A new stage2.js build on docsforsend[.]com. Since November 3, download.docsforsend[.]com/stage2.js serves a shorter build of 9,025 bytes. It still opens with the jQuery 3.6.0 banner and keeps _internalCacheInit, the three /track stages and the persistence names (MicrosoftEdgeSpellCheck, EdgeUpdate.vbs, MicrosoftEdgeWebView.lnk, watchdog.vbs, handler.bat). It copies the NetSupport files to %APPDATA%\DriverWebUpdate, the folder of the transunionbiba[.]lat builds, and adds a launcher.vbs. Its decoy is hxxps://download.docsforsend[.]com/assets/docs/document.pdf. Each download carries its own victim ID, so the file hash changes per download. The package listing still holds the September 23 files and the September 28 package. The whack.sh dropper rule matches this build.
Command and control
Both C2 servers accept connections on port 443 and give no answer to plain HTTP requests, which fits a NetSupport gateway. A NetSupport gateway handles the client's own POST traffic to /fakeurl.htm, and OTX logged hxxp://192.162.199[.]79/fakeurl.htm on September 28, 2026.
91.202.233[.]57 sits in 91.202.233.0/24, announced by Prospero OOO (AS200593). 192.162.199[.]79 belongs to FEMO IT Solutions (AS214351, UK registration). Spamhaus lists both addresses on SBL and DROP.
The 192.162.199[.]79 domain pool
Passive DNS from issued.live shows 33 hostnames on 192.162.199[.]79 since August 2026. On November 2, 22 of them still resolve to it, and Spamhaus lists 20 of those as botnet C2 domains.
21 of the 22 are aged .net names, re-registered between June 23 and August 3, 2026. All of them were pointed at the C2 in one wave on August 24 to 26. The aged Namecheap domains appeared on the MivoCloud delivery server on the same three days. Registry RDAP shows two registration styles:
| Registrar and DNS | Registered | Domains |
|---|---|---|
| Tucows with Njalla DNS | June 23 to 28, 2026 |
abletree[.]net, bentara[.]net, canyonoaksauzzies[.]net, demarchez[.]net, digitalbuys[.]net, dnoi[.]net, grinmaster[.]net, qmsos[.]net, qoofan[.]net, ranchrealestate[.]net, voiceover-professional[.]net, yrgy[.]net
|
| Gname with Gname DNS (share-dns.com) | June 28 to August 3, 2026 |
7tag[.]net, abouhashem[.]net, amikos[.]net, athensgahomes[.]net, charmsco[.]net, flirtcoach[.]net, forselreklam[.]net, librariaonline[.]net, rezodesign[.]net
|
| Cloudflare DNS | nerova[.]cz |
Both recovered client32.ini files name the C2 by its raw IP address, and we hold no sample that names a pool domain. Nothing shows the freight kit itself using these .net names. They may serve other builds, act as a fallback, or belong to a different kit on the same address.
The other 11 names on this address resolve elsewhere or nowhere today: ldsb[.]net, six short-lived .cc names from August 2026 (acurev, cernao, ceruan, curaen, seorna, asenov), avosun.eu[.]cc, sucora[.]cz, vusane[.]top and mauriea.my[.]id. We do not attribute them, since a bulletproof address can change tenants.
FlyMail: a mass email and Telegram platform built for resale
FlyMail, also branded SmartMail with a stylesheet named "BLUE STEEL", is a Russian-language platform for mass email and Telegram outreach. Its login page reads "FlyMail - Vkhod" ("FlyMail - Sign in").
The app behind the login has several sender mailboxes with display names, letter templates per language with photo and video kits, a persona text block, a per-contact correspondence history that marks media already sent, and blacklists. It has no click, open or conversion tracking.
An operator panel titled "FlyAdmin - panel operatora" is built to manage client systems. The front-end React source, 11 files, was readable on the server; the backend was not, so the list below describes what the interface offers. The panel:
- Provisions each client "system" on a new MivoCloud VPS through MivoCloud's API (product IDs 441 to 444, six locations).
- Has a price field for each system and computes income and profit from it. We saw no transaction records.
- Keeps each system's email and Telegram contact bases, exportable to CSV.
- Schedules updates in Moscow time and issues registration links in the form
hxxp://<ip>/register/<token>.
| Address | Role | Names |
|---|---|---|
194.180.191[.]194 |
FlyMail and FlyAdmin |
coblla[.]com (FlyMail), admin.coblla[.]com (FlyAdmin), chat.coblla[.]com (custom chat), mail.coblla[.]com (Mailu), movie.coblla[.]com; FlyAdmin also on studyprod[.]net, learnwhile[.]com, actioninspiration[.]com
|
194.180.191[.]209 |
Second FlyMail installation | FlyMail login, on urlscan since August 4, 2026; goinsideitmore[.]com; earlier secretsprofit[.]info and brighterwealthylife[.]com (both lapsed, see below) |
On November 2, the FlyMail login on .209, coblla[.]com, admin.coblla[.]com and the three other FlyAdmin domains were all online. By November 4 the login on .209 no longer loads. coblla[.]com moved behind Cloudflare at 00:32 UTC that day, and its FlyMail login still loads.
The coblla[.]com certificates trace the build-out: main site August 9, mail September 6, movie September 9, FlyAdmin September 26 and chat October 10, 2026. A sweep of all 5,340 MivoCloud (AS39798) addresses found no other FlyMail or FlyAdmin panel. The resale panel is young: FlyAdmin went live on September 26, 2026, and its dashboard charts still show placeholder data.
How the two operations connect
Each overlap below comes from registration data, passive DNS or Spamhaus. Together they indicate common control. None of them identifies a person.
| Evidence | Detail |
|---|---|
Paired purchases across 194.180.191[.]194 and 194.180.191[.]209
|
On October 10, 2025 (UTC): highgoal[.]info at 06:30 (PDR) to .194; infinitewealthforum[.]com at 06:59 (Tucows, Njalla DNS) to .194; brighterwealthylife[.]com at 07:25 (Tucows, Njalla DNS) to .209. secretsprofit[.]info on October 7 at 06:17 (PDR) to .209. |
| Same buying habits |
studyprod[.]net and learnwhile[.]com registered 5 seconds apart on November 21, 2025, 12:29 UTC, both with Njalla DNS. The purchase windows fall between 09:17 and 10:25 Moscow time. |
| The second FlyMail server shares a name with a NetSupport server |
goinsideitmore[.]com (NICENIC, February 18, 2026) resolves to the pair 194.180.191[.]209 and 194.180.191[.]239 from August to October 2026. |
194.180.191[.]239 is NetSupport infrastructure |
gosidefastandpure[.]com (NICENIC, February 10, 2026): Spamhaus lists it for malware and botnet C2, and @skocherhan tagged it NetSupport on October 24, 2026. |
| The freight kit sits in the same /24 |
194.180.191[.]245; NICENIC registrations for nairawaterfall[.]com and checkyoursecurityfast[.]com; the same per-victim stage beacons. |
| Shared C2 pool habits | 12 of the 22 live C2 pool domains use Tucows with Njalla DNS, the combination the FlyMail operator used for its own domains. Njalla is a common privacy service, so this overlap is weak on its own. |
The FlyMail operator let its October 2025 domains lapse at their first anniversary. On November 2, 2026, the two Tucows names sit on the registrar's expiry parking, and the two PDR .info names point to 127.0.0.1 under PDR's parking nameservers.
Earlier activity
gosidefastandpure[.]com appears in OTX pulses from March 14 to 21, 2026. In those pulses it served a fake CAPTCHA page at /captcha and recorded each victim's progress through /<32-hex token>/started, /completed and /failed. The same habit returns in October as /track?stage=, so the crew ran ClickFix-style lures from at least March 2026, before the VBS chain.
Timeline
| Date (UTC) | Event |
|---|---|
| 2025-10-07 to 10-10 | Paired FlyMail-side domain purchases across .194 and .209 |
| 2025-11-21 |
studyprod[.]net and learnwhile[.]com registered 5 seconds apart |
| 2026-02-10, 02-18, 03-01 |
gosidefastandpure[.]com, goinsideitmore[.]com and forzaverification[.]com registered (NICENIC) |
| 2026-03-14 to 03-21 | Fake CAPTCHA lures with per-victim beacons on gosidefastandpure[.]com
|
| 2026-05-01 |
coblla[.]com registered (Namecheap) |
| 2026-06-23 to 08-03 | Aged .net C2 pool domains re-registered |
| 2026-08-04 | Second FlyMail installation on .209 first seen |
| 2026-08-24 to 08-26 | Aged domains pointed at the MivoCloud delivery server and at C2 192.162.199[.]79
|
| 2026-09-23 | NetSupport package built for C2 192.162.199[.]79 (Kyonix server) |
| 2026-09-26 | FlyAdmin goes live on admin.coblla[.]com
|
| 2026-10-08 | Package for C2 91.202.233[.]57 placed on the MivoCloud server |
| 2026-10-19 |
transunionbiba[.]lat active on the Kyonix server |
| 2026-10-22 | Czech contract of carriage added as a second decoy |
| 2026-10-23, 10-24 | @skocherhan tags MivoCloud and Kyonix domains as NetSupport |
| 2026-10-27, 10-28 |
checkyoursecurityfast[.]com and ajtrucking[.]lat registered |
| 2026-10-29 | @malwrhunterteam posts checkyoursecurityfast[.]com; @smica83 shares the stage 1 VBS |
| 2026-10-31 | Snoopy Triage maps the servers |
| 2026-11-01 02:02 | Abuse reports delivered to MivoCloud and Kyonix |
| 2026-11-02 10:39 |
docsforsend[.]com registered; the kit moves to it by 12:25 |
| 2026-11-02 15:44 to 19:18 | MivoCloud delivery server goes offline |
| 2026-11-02 18:42 |
verifyconnectionsecurely[.]com registered (NICENIC) |
| 2026-11-02 22:46 |
docsforsend[.]com reported to Kyonix; FlyMail reported to MivoCloud |
| 2026-11-03 12:17 |
verifyconnectionsecurely[.]com resolves to the MivoCloud delivery server; the same package is served |
| 2026-11-03 14:31 | Follow-up report to MivoCloud |
| 2026-11-03 | New stage2.js build on docsforsend[.]com (first fetched 20:11) |
| 2026-11-04 00:30 | MivoCloud delivery server offline again |
| 2026-11-04 00:32 |
coblla[.]com moves behind Cloudflare |
| 2026-11-04 | FlyMail login on .209 no longer loads (first seen down at 05:53) |
Takedown status
| Target | Reports | Outcome on November 4, 13:50 UTC |
|---|---|---|
checkyoursecurityfast[.]com, then verifyconnectionsecurely[.]com, on MivoCloud 194.180.191[.]245
|
November 1, 02:02 UTC; follow-up November 3, 14:31 UTC | Offline from November 2 (between 15:44 and 19:18 UTC); back under the new domain on November 3; offline again since November 4, 00:30 UTC. No reply. |
ajtrucking[.]lat, then docsforsend[.]com, on Kyonix 2.27.63[.]78
|
November 1, 02:02 UTC; November 2, 22:46 UTC | Online and serving the kit. No reply, no sign of action. |
FlyMail servers 194.180.191[.]194 and .209 |
November 2, 22:46 UTC | The .209 login no longer loads. coblla[.]com is online behind Cloudflare. |
| C2 servers and the C2 pool | Not reported | Both C2s accept connections on 443; all 22 pool domains resolve to 192.162.199[.]79. |
194.180.191[.]239 (gosidefastandpure[.]com), 5.252.177[.]183 (forzaverification[.]com) and 150.241.66[.]223 (sakenlogistics[.]com) also no longer answer. We did not report them.
Detection
On endpoints, look for:
-
msedgewebview.exeorupdaterdriveon.exerunning from%APPDATA%\UpdateHelper,%APPDATA%\DriverWebUpdateor%LOCALAPPDATA%\Microsoft\Edge\ComponentUpdate. - The HKCU Run value
MicrosoftEdgeSpellCheck. -
EdgeUpdate.vbsorMicrosoftEdgeWebView.lnkin the Startup folder. -
watchdog.vbsandhandler.batin%LOCALAPPDATA%\Microsoft\EdgeUpdate\runtime. -
%TEMP%\EdgeWebView2Check.log. -
launcher.vbs, added by the November 3 build. - curl.exe and tar.exe launched by wscript.exe or cscript.exe.
On the network, look for:
- Requests to
/stage2.js?id=,/track?id=...&stage=and/assets/pkg/package.tar.gz. - Outbound TCP 443 to
91.202.233[.]57or192.162.199[.]79, or POSTs to/fakeurl.htm.
whack.sh scans flag the stage2.js dropper in all six builds we hold, from transunionbiba[.]lat through the November 3 docsforsend[.]com build, and client32.ini files made with NetSupportConfigBuilder.
Indicators
Domains
| Domain | Role |
|---|---|
checkyoursecurityfast[.]com, verifyconnectionsecurely[.]com, nairawaterfall[.]com, pietreez[.]net, heartnex[.]org, odenselam[.]com
|
Kit domains, MivoCloud delivery server |
transunionbiba[.]lat, ajtrucking[.]lat, docsforsend[.]com
|
Kit domains, Kyonix delivery server |
sakenlogistics[.]com, youlovemybiba[.]com, forzaverification[.]com
|
Related kit domains |
gosidefastandpure[.]com, goinsideitmore[.]com
|
NetSupport server 194.180.191[.]239 |
coblla[.]com, studyprod[.]net, learnwhile[.]com, actioninspiration[.]com
|
FlyMail and FlyAdmin |
| See the pool table above | C2 pool on 192.162.199[.]79 |
IP addresses
| IP | Network | Role |
|---|---|---|
194.180.191[.]245 |
MivoCloud | Delivery server (freight kit, C2 #1 package) |
2.27.63[.]78 |
Kyonix | Delivery server (freight kit, C2 #2 package) |
150.241.66[.]223 |
Kyonix |
sakenlogistics[.]com, youlovemybiba[.]com
|
194.180.191[.]239 |
MivoCloud |
gosidefastandpure[.]com, goinsideitmore[.]com
|
5.252.177[.]183 |
MivoCloud | forzaverification[.]com |
91.202.233[.]57 |
Prospero | NetSupport C2 #1, port 443 |
192.162.199[.]79 |
FEMO IT | NetSupport C2 #2, port 443 |
194.180.191[.]194 |
MivoCloud | FlyMail and FlyAdmin (coblla[.]com) |
194.180.191[.]209 |
MivoCloud | Second FlyMail installation |
SHA256
| Hash | File |
|---|---|
6f0d6718fff59b26130d7ee64b050d8b558e691d1515e7dc02c442feac660683 |
Stage 1 VBS "Document 9523_0951.vbs" |
236ae97e52af5482c7ce492efaee3543cc5cbd6f2fa352bc158e7a311d91bf9c |
stage2.js (checkyoursecurityfast[.]com) |
be8d3f4914e2ccf545a9e591f3f745f4887ffdd7d451abebea75bba4f4891040 |
stage2.js (ajtrucking[.]lat) |
03b31fc179d8b7eeec161d681db5add359c3ee5cb70c207d81c54a2f9d1f927f |
stage2.js (docsforsend[.]com) |
a5cb7590d0a78abdb0c162c45525823488f5c39210ad37c1ce69ba4a61061b11 |
stage2.js (docsforsend[.]com, November 3 build, per-download hash, example from November 3) |
f5e24c80281117dfc2809720c60abd7cabbc972097707151d226f952f55a7ec0 |
stage2.js (docsforsend[.]com, November 3 build, per-download hash, example from November 4) |
77372851784be04034c7b67e1572791daa7db2a337eddf5b25fff4a9a01ff186 |
stage2.js (transunionbiba[.]lat) |
fdde7dce19a648f194e9b8a31f9377d2cda3b0b6d5fc660b09f609afb2baa060 |
stage2.js (transunionbiba[.]lat) |
60c8fa7fedc71c99acae1322658fe683ad7e029241307decfe9b2449ef63230f |
package.tar.gz (checkyoursecurityfast[.]com) |
06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268 |
msedgewebview.exe (NetSupport client32.exe) |
1271211779412c8353357285892bdf1eef11f579fa7b329aa27af4dd4d8c573b |
client32.ini, C2 91.202.233[.]57 |
c911c67af72a312348eb212e99eac49018ecd7a88f971ac66ac03ba202421b6d |
client32.ini, C2 192.162.199[.]79 |
b7818edeb28f19baba42c8aef7a2a232dc008fd361d1184a982801255392c85e |
NSM.LIC (GJHYUT534 / NSM280812) |
51aa6dd54ababba9b535c98ca06f819d59e2ace75faff0755e9ec1922c2c2712 |
Decoy document.pdf |
122feab5f4d0d219f9dd8aefd61857c7900c6713adde5033d4a35772f5582571 |
Decoy eudoc.pdf |
Not linked
-
172.104.98[.]35(Linode): a shared sinkhole or parking address with more than 430 unrelated domains. - Akamai 23.x addresses: registrar parking.
- The forum seller "smartmail" (zenno.club,
zenno-bots[.]top): same name, no shared infrastructure. - A fake-employer recruitment kit (
novabeyondapply[.]com,norlin-solutions[.]worksand others) with redirectors on MivoCloud5.252.177[.]82: it shares only the hosting provider, and its stack differs. -
telluapp[.]top, a Russian-language Telegram mini-app on Kyonix: no shared infrastructure with FlyMail.
Sources and evidence gaps
Third-party data came from Spamhaus (DBL, SBL, DROP), urlscan.io, OTX, MalwareBazaar, Cert Spotter, RIPEstat and registry RDAP. Passive DNS and certificate history came from issued.live.
We hold no NetSupport sample that names a C2 pool domain, and no hosting provider has confirmed the account behind any server.
Thanks to @malwrhunterteam, @skocherhan and @smica83, whose public posts started and extended this investigation. Analysis by Snoopy Triage.
Top comments (0)