Just finished analyzing a NetSupport RAT sample and the infection chain was way more interesting than expected.
This wasn’t custom malware, it was a legitimate NetSupport Client silently repurposed into a remote access backdoor. My observations from the detonation:
Encrypted ZIP loader (classic phishing delivery)
PowerShell execution policy bypass
Dropping the NetSupport client in a hidden folder
Abuse of forfiles.exe to indirectly launch RAT through explorer.exe
C2 communication via HTTPS POST
System enumeration (proxy settings, IE security, locale, hostname)
No embedded config , everything loaded externally
Multiple Suricata + YARA detections
Clear IOCs: process tree, mutex, network signatures, and dropped payload paths
I also documented all Indicators of Compromise and wrote a full endpoint cleanup workflow (registry keys, persistence, proxy resets, credential rotation, etc.).
If you work in IR, SOC, or are learning malware analysis , this sample is a great case study in legit tool gone wrong.