Hunt the MP4 that never plays: NetSupport in an ISO-BMFF uuid box

You know the ticket. Someone downloaded a video. The ticket says media. The player refuses to open it. Antivirus already shrugged and called it an MP4. There is no ransomware family name on the alert, and the user swears they never watched anything. That unfair case is when this chain wants you to close it and move on.

Here is the plain version before the box jargon. The file is a fake video shell. It is stuffed with a script. It is not a clip you failed to open. It is a carrier built to look like an MP4, so type checks and tired triage let it through, while the real payload waits inside.

Censys was published on 28 August 2026. Observation started 22 August. Outside their write-up and a couple of mirrors, coverage is still thin. If you came in hunting another NetSupport note, you are hunting the wrong leftover. File-type checks say MP4. Players, including anything that leans on ffprobe, say unplayable. Almost the whole file is a private ISO-BMFF UUID box holding XOR-keyed PowerShell that drops silent NetSupport. Hunt the carrier and the leftovers, not another NetSupport family name. The case is the video that never plays, the Run value that borrowed Defender's name, and the Public folder that should not hold a remote-admin client.

How the fake MP4 reaches the endpoint

The story Censys ARC caught starts on a Cloudflare-fronted host that serves raw PowerShell as text/HTML on port 80. That first script checks the computer name against hard-coded "clean" style guards, hides its console, and reaches back to the same origin on a different path for more code. The follow-on script then fetches an MP4 with a fake Chrome user-agent so the download looks like ordinary media traffic instead of a dropper pull.

What arrives is the shell you already met in plain English. Inside the container, a build-specific parser walks the ISO-BMFF boxes until it finds a UUID entry that matches its selector. If the selector is missing, often because the operator rotated carriers without keeping older builds alive, the script exits. That rotation is operational noise for them. For you, it is a reminder that a quiet miss on one build is not a clean estate.

The carrier itself is about 6.5 MB. Shallow file-type checks accept it as MP4. A single private UUID box occupies roughly 99.95 percent of the bytes, and that box holds an embedded XOR key plus compressed PowerShell that expands toward 17 MB. The rest of the container is truncated. Standard decoders reject it. The "video" track has zero-by-zero dimensions and lacks the parameters a real player needs. It is a shell built to pass automated type checks while moving a large script past people who only triage on extension and magic bytes.

I am not going to reconstruct the XOR decode, the PowerShell dropper, or the NetSupport install step by step. You do not need the recipe. You need the leftovers.

What lands after the UUID box opens

When that UUID box opens, the chain does not leave you a playable file. It leaves a NetSupport client in a randomized subdirectory under C:\Users\Public. The bundle includes legitimate-looking redistributables such as Vulkan and SwiftShader, so the tree looks like a normal software install at a glance. The client is configured for silent operation. Persistence is a Run value named SecurityHealth that points to the real Defender paths. That name is the masquerade. On a casual registry skim, it is meant to look like the Windows Defender tray helper.

Censys also recorded a run-once marker under ProgramData with a .ch_ style name, intermediate staging under Temp as a .ps1, and cleanup of HKCU\...\Explorer\RunMRU, which is why they infer a Run-dialog style entry even though the lure itself was not captured. The console-hiding class string __HideConsole shows up in the early PowerShell bodies, and Censys surfaces the live cluster with that string plus ProgramData in the HTTP body. On the network side, the same origin family serves both the PowerShell and the MP4 carrier. The active C2 gateway in the recovered profile is gojirotomiodid[.]com on 443, with a secondary gateway staged without an A record. Those domains were registered about 77 seconds apart on 21 August, the same day the delivery kit appears to have been stood up.

Hunt the carrier, not another NetSupport

Start with the mismatch, not the RAT brand. An .mp4 written to disk and then opened by powershell.exe or pwsh.exe is not training footage. That is the carrier being cracked open. The same shape shows up on the network side when Zeek or a proxy labels a download as video while the payload is PowerShell-as-HTML, or when an MP4 never behaves like media at all.

Persistence that borrowed Defender's name is the next leftover that actually sticks. A Run value called SecurityHealth, whose data does not land under the real Windows Defender paths, is not a health check. It is the decoy Censys documented, and it is meant to survive a skim that stops at the value name.

Under Public, you are looking for a NetSupport-shaped tree in a random folder, including client32.ini and those decoy redistributables. That is not helpdesk tooling you forgot you bought. Pair it with a .ch_ style run-once marker under %ProgramData%, DNS or host hits to the carrier and gateway names Censys published (including gojirotomiodid.com), and process or script telemetry that mentions __HideConsole. Those are the leftovers that survive when the RAT family name in the write-up does not.

Do not wait for a weekend outbreak. Observation started on 22 August. The report landed on 28 August. Coverage is still thin. A clean bill is not "we block NetSupport." A clean bill is quieter than that: you can see PowerShell touching fresh MP4s, you can see SecurityHealth pointing somewhere that is not Defender, you can see Public hosting a silent client, you can see the named infra, and those hunts are quiet. Anything short of that is still the video that never played.

Fake MP4 NetSupport hunts

Paste these. They are bound to the artifacts above. The window starts at datetime(2026-08-22), same as the observation lead. They do not reconstruct the decode or the install.

Hunt fake MP4 NetSupport in KQL

DeviceFileEvents
| where Timestamp >= datetime(2026-08-22)
| where FileName endswith ".mp4"
| where ActionType in ("FileCreated", "FileModified", "FileOpened")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256,
    InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceFileEvents
| where Timestamp >= datetime(2026-08-22)
| where FolderPath has @"C:\ProgramData"
| where FileName startswith ".ch_"
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256,
    InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceRegistryEvents
| where Timestamp >= datetime(2026-08-22)
| where RegistryKey has @"CurrentVersion\Run"
| where RegistryValueName =~ "SecurityHealth"
| where isempty(RegistryValueData)
   or not(RegistryValueData has_any (
        @"Windows Defender",
        @"Microsoft\Windows Defender",
        "SecurityHealthSystray",
        "SecurityHealthService"))
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName,
    RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine

union DeviceFileEvents, DeviceProcessEvents
| where Timestamp >= datetime(2026-08-22)
| where FolderPath has @"C:\Users\Public"
| where FileName =~ "client32.ini"
   or FileName has_any ("Vulkan", "SwiftShader", "HtCtl32", "PcIcl32", "NsM.ini", "NsM.LIC")
   or (FolderPath has @"C:\Users\Public" and FileName endswith ".exe"
       and InitiatingProcessFileName has_any ("powershell.exe", "pwsh.exe", "cmd.exe"))
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessFileName, SHA256

DeviceNetworkEvents
| where Timestamp >= datetime(2026-08-22)
| where RemoteUrl has_any (
    "gojirotomiodid.com",
    "kolitersdones.com",
    "binance-idexchange.com",
    "approvalrequest-api.com",
    "karlenagida.com",
    "usersecuritycheck.com",
    "brmconfig.com",
    "hurmadll.com")
   or RemoteIP in ("176.65.144.164", "89.34.90.111")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort,
    InitiatingProcessFileName, InitiatingProcessCommandLine

union DeviceProcessEvents, DeviceFileEvents, DeviceImageLoadEvents
| where Timestamp >= datetime(2026-08-22)
| where ProcessCommandLine has "__HideConsole"
   or InitiatingProcessCommandLine has "__HideConsole"
   or FileName has "__HideConsole"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine

Hunt fake MP4 NetSupport in Falcon CQL

(#event_simpleName=FileWritten OR #event_simpleName=FileOpenInfo) timestamp:>=2026-08-22
| FileName=/\.mp4$/i
| ContextBaseFileName=/^(?i)(powershell|pwsh)\.exe$/

(#event_simpleName=FileWritten OR #event_simpleName=FileOpenInfo) timestamp:>=2026-08-22
| FilePath=/(?i)ProgramData/
| FileName=/^\.ch_/

#event_simpleName=RegistryValueUpdate timestamp:>=2026-08-22
| RegistryValueName=/^(?i)SecurityHealth$/
| RegistryKeyPath=/(?i)CurrentVersion\Run/
| RegistryValueData!=/(?i)(Windows Defender|SecurityHealthSystray|SecurityHealthService)/

(#event_simpleName=FileWritten OR #event_simpleName=ProcessRollup2) timestamp:>=2026-08-22
| FilePath=/(?i)Users\Public/
| (FileName=/(?i)client32\.ini/ OR FileName=/(?i)(Vulkan|SwiftShader|HtCtl32|PcIcl32|NsM\.ini|NsM\.LIC)/ OR (FileName=/\.exe$/i AND ParentBaseFileName=/^(?i)(powershell|pwsh|cmd)\.exe$/))

(#event_simpleName=DnsRequest OR #event_simpleName=NetworkConnect) timestamp:>=2026-08-22
| (DomainName=/(?i)(gojirotomiodid\.com|kolitersdones\.com|binance-idexchange\.com|approvalrequest-api\.com|karlenagida\.com|usersecuritycheck\.com|brmconfig\.com|hurmadll\.com)/ OR RemoteAddressIP4=/(176\.65\.144\.164|89\.34\.90\.111)/)

#event_simpleName=ProcessRollup2 timestamp:>=2026-08-22
| CommandLine=/(?i)__HideConsole/

Hunt fake MP4 NetSupport in Splunk

earliest=08/22/2026:00:00:00
(index=sysmon OR index=windows OR index=proxy OR index=zeek OR index=crowdstrike)
(
  (EventCode IN (11,15,23) AND file_name="*.mp4" AND (process_name="powershell.exe" OR process_name="pwsh.exe"))
  OR (file_path="*\\ProgramData\\*" AND file_name=".ch_*")
  OR (EventCode=13 AND registry_value_name="SecurityHealth" AND registry_path="*CurrentVersion\Run*"
      NOT registry_value_data="*Windows Defender*"
      NOT registry_value_data="*SecurityHealthSystray*"
      NOT registry_value_data="*SecurityHealthService*")
  OR (file_path="*\\Users\Public\\*" AND (file_name="client32.ini" OR file_name="*Vulkan*" OR file_name="*SwiftShader*" OR file_name="NsM.ini" OR file_name="NsM.LIC"))
  OR (query="*gojirotomiodid.com*" OR query="*kolitersdones.com*" OR dest="gojirotomiodid.com" OR dest="kolitersdones.com"
      OR dest_ip IN ("176.65.144.164","89.34.90.111")
      OR url IN ("*binance-idexchange.com*","*approvalrequest-api.com*","*karlenagida.com*","*usersecuritycheck.com*","*brmconfig.com*","*hurmadll.com*"))
  OR (CommandLine="*__HideConsole*" OR ImageLoaded="*__HideConsole*" OR ScriptBlockText="*__HideConsole*")
  OR (sourcetype=zeek* AND (uri_path="*.mp4" OR filename="*.mp4") AND (mime_type!="video/*" OR resp_mime_types!="video/*" OR (uri_path="*.mp4" AND (user_agent="*PowerShell*" OR method!="GET"))))
)

Hunt fake MP4 NetSupport in Kibana

@timestamp >= "2026-08-22" AND (
  (file.name:*.mp4 AND process.name:(powershell.exe OR pwsh.exe))
  OR (file.path:*ProgramData* AND file.name:.ch_*)
  OR (registry.value:"SecurityHealth" AND registry.path:*CurrentVersion\Run* AND NOT registry.data:(*Windows*Defender* OR *SecurityHealthSystray* OR *SecurityHealthService*))
  OR (file.path:*Users\Public* AND file.name:(client32.ini OR *Vulkan* OR *SwiftShader* OR NsM.ini OR NsM.LIC OR HtCtl32* OR PcIcl32*))
  OR dns.question.name:(*gojirotomiodid.com* OR *kolitersdones.com* OR *binance-idexchange.com* OR *approvalrequest-api.com* OR *karlenagida.com* OR *usersecuritycheck.com* OR *brmconfig.com* OR *hurmadll.com*)
  OR (destination.ip:("176.65.144.164" OR "89.34.90.111"))
  OR process.command_line:*__HideConsole*
  OR (url.path:*.mp4 AND NOT http.response.mime_type:video/*)
)

Sources

Censys, The Video That Plays You: Fake MP4 File Carries Malicious Payload, 28 August 2026. Observation started 22 August 2026.

Additional Censys-named hosts not in the paste: web02message.com, tidalcoastapparel.com, fdn4apex.com, x2664.com, 2oauth.com.

What This Means for Your Team

This case does not open on a NetSupport signature. It opens when an MP4 fails to play, and PowerShell still cares about it. SecurityHealth that does not point at Defender is the persistence. Public hosting a silent remote-admin client, with the decoy redistributables and a ProgramData .ch_ marker nearby, is the landing zone. If your hunts only watch the RAT brand, you will miss the carrier that got it there. Observation is already almost two weeks old, and the mirrors are still thin. Hunt the leftovers while the write-up is quiet.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We use the Defender, Sentinel, Conditional Access, and Azure licenses you already have. For this chain, we hunt PowerShell that creates, modifies, or opens fresh MP4s, Run values that borrow Defender's name, NetSupport-shaped trees under Public, ProgramData .ch_ markers, __HideConsole in script telemetry, and DNS to the carrier and gateway infra Censys mapped.

Assessing Your Security Posture with a Free Inception Foresight M365 Assessment

Want to see where your environment stands against carriers like this, not just the RAT brand on the ticket? Grab our free Inception Foresight M365 Assessment. No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on X.