Overview
overview
10Static
static
3malware/Au...re.dll
windows10-2004-x64
3malware/Au...re.dll
windows11-21h2-x64
3malware/HTCTL32.dll
windows10-2004-x64
3malware/HTCTL32.dll
windows11-21h2-x64
3malware/KBDTAM99.dll
windows10-2004-x64
1malware/NSM.lic
windows10-2004-x64
3malware/NSM.lic
windows11-21h2-x64
3malware/NSM.ini
windows10-2004-x64
1malware/NSM.ini
windows11-21h2-x64
3malware/PCICHEK.dll
windows10-2004-x64
3malware/PCICHEK.dll
windows11-21h2-x64
3malware/PCICL32.dll
windows10-2004-x64
3malware/PCICL32.dll
windows11-21h2-x64
3malware/Ts...on.dll
windows10-2004-x64
6malware/Wi...64.dll
windows10-2004-x64
1malware/client32.exe
windows10-2004-x64
10malware/client32.exe
windows11-21h2-x64
10malware/client32.ini
windows10-2004-x64
1malware/client32.ini
windows11-21h2-x64
3malware/comcat.dll
windows10-2004-x64
1malware/getuname.dll
windows10-2004-x64
1malware/ifsutilx.dll
windows10-2004-x64
1malware/in...rences
windows10-2004-x64
1malware/in...rences
windows11-21h2-x64
1malware/libEGL.dll
windows10-2004-x64
1malware/libssp-0.dll
windows10-2004-x64
1malware/libssp-0.dll
windows11-21h2-x64
1malware/li...-1.dll
windows10-2004-x64
1malware/li...-1.dll
windows11-21h2-x64
1malware/mprext.dll
windows10-2004-x64
1malware/msidle.dll
windows10-2004-x64
1malware/msidntld.dll
windows10-2004-x64
1General
-
Target
malware 1.zip
-
Size
2.8MB
-
Sample
250604-rn4vgsy1cw
-
MD5
bf4f8ee2e56c79cf4ff988294f95be78
-
SHA1
ea99bfc2f6fa8ea75cd28974c1ad8973cb515c6b
-
SHA256
0f8479e74eba02574be8a12e91eba991e4a792600d7c9fdde7a62707431d52b0
-
SHA512
35d67d0974db9a5774b8dc78cba8e7fc48e5802af10ea58c3b6dc81e8abbc978aeef57d4d7abfef3a8328e1a348be4863f5d5b5bc3f29056c854432a6bf387d7
-
SSDEEP
49152:YF6Mmqogo3Sfb3KfGpQsijDD+nRsDgAFL0kJzJbkGbJlh//+pjcxzMaPw8U0Gfpa:YcpqMSDGsiXEyXJzJbkGHh//+RctPw8p
Static task
static1
Behavioral task
behavioral1
Sample
malware/AudioCapture.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
malware/AudioCapture.dll
Resource
win11-20250502-en
Behavioral task
behavioral3
Sample
malware/HTCTL32.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
malware/HTCTL32.dll
Resource
win11-20250508-en
Behavioral task
behavioral5
Sample
malware/KBDTAM99.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
malware/NSM.lic
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
malware/NSM.lic
Resource
win11-20250502-en
Behavioral task
behavioral8
Sample
malware/NSM.ini
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
malware/NSM.ini
Resource
win11-20250502-en
Behavioral task
behavioral10
Sample
malware/PCICHEK.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
malware/PCICHEK.dll
Resource
win11-20250502-en
Behavioral task
behavioral12
Sample
malware/PCICL32.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
malware/PCICL32.dll
Resource
win11-20250502-en
Behavioral task
behavioral14
Sample
malware/TsUsbRedirectionGroupPolicyExtension.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
malware/WiaExtensionHost64.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
malware/client32.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
malware/client32.exe
Resource
win11-20250502-en
Behavioral task
behavioral18
Sample
malware/client32.ini
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
malware/client32.ini
Resource
win11-20250502-en
Behavioral task
behavioral20
Sample
malware/comcat.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
malware/getuname.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
malware/ifsutilx.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
malware/initial_preferences
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
malware/initial_preferences
Resource
win11-20250502-en
Behavioral task
behavioral25
Sample
malware/libEGL.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
malware/libssp-0.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
malware/libssp-0.dll
Resource
win11-20250502-en
Behavioral task
behavioral28
Sample
malware/libwinpthread-1.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
malware/libwinpthread-1.dll
Resource
win11-20250502-en
Behavioral task
behavioral30
Sample
malware/mprext.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
malware/msidle.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
malware/msidntld.dll
Resource
win10v2004-20250502-en
Malware Config
Targets
-
-
Target
malware/AudioCapture.dll
-
Size
76KB
-
MD5
2a82792f7b45d537edfe58eb758c1197
-
SHA1
a039182d4d1ef29c6d8c238f20f7b8218c28f90c
-
SHA256
05aa13a6c1d18f691e552f04a996960917202a322d0dacfd330e553ad56978ed
-
SHA512
c6c6799b386e0d6489d9346f1d403b03b9425572e7418a93a72c413a4b9413945aaf4ea97a7d7b65772e5e3f00cff65f180f6fef51a26d4fdc2ff063816b5386
-
SSDEEP
1536:96Y+zbZm8/v/k957pyPkLDfORFMTlrSWqNj5CdnTrioQ+ywlj5CdnTXZQ+8iA:96Y+HQ8/3k9RppYFclrLqNj5CdnTrIwp
Score3/10 -
-
-
Target
malware/HTCTL32.DLL
-
Size
306KB
-
MD5
3eed18b47412d3f91a394ae880b56ed2
-
SHA1
1b521a3ed4a577a33cce78eee627ae02445694ab
-
SHA256
13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f
-
SHA512
835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990
-
SSDEEP
6144:Jd0nVF1ZtRq6itu9i3uxUnNPhMKj8TwFIKhJ08fvF0dGhZUbol:JYZrokUnNPhMY8TwFIcJB0i
Score3/10 -
-
-
Target
malware/KBDTAM99.DLL
-
Size
7KB
-
MD5
ccc736781cf4a49f42cd07c703b3a18b
-
SHA1
6ad817d7e8b7e9dc978763305a4cd4f1ab9abb66
-
SHA256
000c4b5b50966634df58078511794f83690d693fccf2aca5c970c20981b29556
-
SHA512
39245c4ba554a5a178310af2b8578401360bf60efda427332249eca02d6d65e4b419270ba648e4ad36aacca810133f8e4404372dee98a3648c1e4a9b85dedccb
-
SSDEEP
96:Ze+NFyw5fGU1irzSJ39uEMpi4nKW8cWwBvv:ZrNgUiyJ393W8cWq
Score1/10 -
-
-
Target
malware/NSM.LIC
-
Size
262B
-
MD5
b9956282a0fed076ed083892e498ac69
-
SHA1
d14a665438385203283030a189ff6c5e7c4bf518
-
SHA256
fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc
-
SHA512
7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb
Score3/10 -
-
-
Target
malware/NSM.ini
-
Size
5KB
-
MD5
99f493dce7fab330dc47f0cab8fe6172
-
SHA1
16906fb5988303bb462b65ff4ece23539a12f4b5
-
SHA256
e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d
-
SHA512
2c58171c30aec8ae131a7c32162856fce551b55f861d0d9fb0e27a91bd7084388df5860392f80cdbc6df6e64e97d8bf2cae587c3d6b7c142ce711ae8e240bb01
-
SSDEEP
96:L1DgNnkStXsfpsNXl0o1n49+jJeQScwzTHXllBXl3SXlcwah0SgAh0su9h0kEhhd:h4nt9kgamEvfUsrywp7
Score3/10 -
-
-
Target
malware/PCICHEK.DLL
-
Size
27KB
-
MD5
e311935a26ee920d5b7176cfa469253c
-
SHA1
eda6c815a02c4c91c9aacd819dc06e32ececf8f0
-
SHA256
0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e
-
SHA512
48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c
-
SSDEEP
768:X52mBHj1XCdnJ8EriRGp9E+l/kaTj1XCdnJ8EZp9E+8iROA:JPBHj5CdnTrioQ+l/kaTj5CdnTZQ+8iX
Score3/10 -
-
-
Target
malware/PCICL32.DLL
-
Size
3.3MB
-
MD5
1274cca13cc5e37ca94d35e5b0673e89
-
SHA1
a8754c94f88273c304bc45a5afd61a383bb52117
-
SHA256
cd5510c8bc7ea60be77ad4aab502ee02d871bf4e917aeeb6921c20eebd9693dd
-
SHA512
52eafa31ee942dc92d0b8f52c12206f6abc1d5fae799b37b371e97c38ce66bd0693263de86b4880748ba1405054701288caf2cd00cd327edc164e1390cf9191c
-
SSDEEP
49152:MTKIG4K8I37tlHf2ikvy7V/lE8gHT4RaCg6cOWSbWc/id:MTKIG4D+tlHfnR/lE8tHgkWSP/i
Score3/10 -
-
-
Target
malware/TsUsbRedirectionGroupPolicyExtension.dll
-
Size
13KB
-
MD5
d89cda3ff8427da82de6cce39008c5bc
-
SHA1
33889517517b8953707796d12d6907b039c715d1
-
SHA256
f44cc1e23d0d192dcfd84069b27704cd0b2a8e7720eee43656f57cb474433762
-
SHA512
4a73be7228960719236f39abc6dba7741498d3a3539f7bcc31b6d28a2574e41e4f85e6c2e0fbcffe9ba3b6a646fa3fa078adc0a53c46a4676b871fb92e11fe4f
-
SSDEEP
192:wWMcTgQEri3hPkpzRK7KVM6cqm+saSLysnlsam4oIWa+W8:wWpTgTu3ypzRo61mVag9Jm4oIWa+W
Score6/10-
Adds Run key to start application
-
-
-
Target
malware/WiaExtensionHost64.dll
-
Size
11KB
-
MD5
5d084613c0e5c8c3022d9e0f316b0e23
-
SHA1
784dd38d9e553eb4b8955320fb596ae4e6854f23
-
SHA256
07bc4dc48d5d9bcc2ce52ca8a0f925ca021092dc34cb811e183cbc0d32e576ba
-
SHA512
263d3de392b5a4e40e9fbd791062b2731f27410e977dbdacb61810d1a1c2cf24658d8abf5d09a99a18ff7a87c122d9b6744d40723c1637621c5feb327fad752a
-
SSDEEP
192:A21YiMppUPSz/pO6IsVTHzdZpCIdglelWWaCtW:AviMppB/w6NTTbXlWWaCtW
Score1/10 -
-
-
Target
malware/client32.exe
-
Size
117KB
-
MD5
1c19c2e97c5e6b30de69ee684e6e5589
-
SHA1
5734ef7f9e4dba0639c98881e00f03eea35a62ee
-
SHA256
312a0e4db34a40cb95ba1fac8bf87deb45d0c5f048d38ac65eb060273b07df67
-
SHA512
ab7240b81be04f1bced47701a5791bbeedcba6037ee936327478c304aa1ce5ae75856ca7f568f909f847e27db2a6b9c08db7cc1057a18fab14a39a5854f15cba
-
SSDEEP
768:mfVZl6FhWr80/Lqar2pe/KLKFKcMkuNr2pe/PNKFKcMkM:m70hGTqaee/CIr4ee/VIrI
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
-
-
Target
malware/client32.ini
-
Size
1KB
-
MD5
fce60232070183d3f7510e2a5513d993
-
SHA1
0aa8cbd6371aefcf1f8577e8e0a276330731a779
-
SHA256
747618b8c54626ca710c1321e8c6419308a5248bc94ec7105dbcb2fdf843325e
-
SHA512
41e9e6d7d28935065109cab5a1785beb94441552bae24f9e6b120ae4c2f4f69f16f65cd01fa7bd77e50e94f1bf3b944e8cb31771827f32d356be6d6c3d69722e
Score3/10 -
-
-
Target
malware/comcat.dll
-
Size
10KB
-
MD5
835ff05a3f5e16e0fe41e515ea398bd4
-
SHA1
e025cb17bbb01a1b5715ebbc745272a8611dae6c
-
SHA256
8dcfb1e6aa965df4bd4c0551d03bdfd6472c80219ada4671910958688fbb4ab6
-
SHA512
e6a7002316b05759c433b3e0516843a14199ee4b23315d799b533a52f9932f4715fc8aa5fae96892901ac67f0dae6d239eb37fc722558cb7c9dd906564719cd1
-
SSDEEP
96:j6cuh8B0DNcU2QD6SNkdSWn+smK/4W70ADlqNXEWPT0lF+WwUL:jLuTkDSNkQ+h4WoADlBW7a+W
Score1/10 -
-
-
Target
malware/getuname.dll
-
Size
11KB
-
MD5
91c68038bfc064ea8fb6d432acd38ee0
-
SHA1
4df7e33b6e325f31231eaaab366e2e710955babb
-
SHA256
68de057c4175d4c94afa2acb2abc1a9ccac04a3ceb8e84c33f7f414bb8b0eeb6
-
SHA512
002aef67593058c88b980a4107f1ca4ddfec5268456f76d1d358179e00ea2a0cd64c93fb31a7e78055885cfd508c90a7b19c6c6fa7a5a3c3ffa305677a0955d2
-
SSDEEP
192:f3emo46V4w9263FeVpszrEc3YDtmWIdW:Vocw99e8YRmWIdW
Score1/10 -
-
-
Target
malware/ifsutilx.dll
-
Size
16KB
-
MD5
27a7213091cda31e84967bead4d29bd1
-
SHA1
e705e0fd25167c8cdaf984f067e3bdf4be8558d3
-
SHA256
42214053995b6188b2e20935ca8c92af77639f0d5541a132920a5cba2cfcbde6
-
SHA512
a16ee540cad2661f3d31071aed3b2f30ea5c0f068f51a350ef693fb83df30ce97ea4701714091ed0ef4a0806d908d93691beb0d8060b5ec73f62422477c8f3ce
-
SSDEEP
192:peIxDV4pntj/Hi3SbYMS9HERLChPjuARtNlvJy7VfYN7EcX2D1WsZW:peIxp4pntja35JExChjhtWYNZ2xWsZW
Score1/10 -
-
-
Target
malware/initial_preferences
-
Size
693KB
-
MD5
2973639794b095b240a5c4af2c23fcbf
-
SHA1
5413cf9213db3f09344ddec363d4c431ee05dc67
-
SHA256
48869dffdd9e50569289daab5365fd4aedb8e64577dc71b9e95465e22d828e5a
-
SHA512
e3bf0cb51a949eb558cf444a90b37bf7bd60a23ad360dc8cc40690000d10415a307410f93b900289ef618208d093ee0a1e34c546ce6147529b4a157cdd9bd1c8
-
SSDEEP
12288:xOhdbgnPYW0lquxG4in2hm1vmHJAD89utQ0R76ZTWXha2ydbHGeXW74tFi:xCJW07xG4o2I1+HJ1wQo76ZMXoTXW0tM
Score1/10 -
-
-
Target
malware/libEGL.dll
-
Size
493KB
-
MD5
4291d4ba9edbcf567fb9f2397c168431
-
SHA1
9903889a223dd4083ad011060d3b9fcefa34953f
-
SHA256
fd626c18e2c6ae437d288dfb5a9f4039bd5a3a68d01183a18cc25fb37ca48cd7
-
SHA512
fab2151159973e6ce6ef8759548a44be8d09ca7577c451391c26d7d384f2efebfc0554b14e9fafa53428adf8f61deb27b32d001a58b2d94b1e1af20023caf26d
-
SSDEEP
12288:i4ufaxKM0UUQLjS2K0oa2fVE1M8mCL55ZHb3:/xKM0UUPooFa5ZHT
Score1/10 -
-
-
Target
malware/libssp-0.dll
-
Size
15KB
-
MD5
d37b46aaa0276d199d13ddbc06b53fb6
-
SHA1
5b37e302e826488bca5f29a1fe6c9d3e3037979e
-
SHA256
e1b206a63410bdb6d91a7a61941e7329b3309d93d43b4a1d35df890713c0a1f1
-
SHA512
819a5cd39f61f2de2203029fc2788612a2355b85c7f9f499a9e72cb4ef5c182610d72e8a0a592eac9e006853e5fd993ea471d5d1f2be5af9ea5367e3e2d8f7b0
-
SSDEEP
192:sYRdUKvxkxqf6JAHTRhrrgDdVnwqKfIPf+91wjQtOqH7UaG8xBtq:lRdfEOpzRhr0frckf+PhtOqbBxBtq
Score1/10 -
-
-
Target
malware/libwinpthread-1.dll
-
Size
54KB
-
MD5
ec5d913ae28217edee26445e1c151aa5
-
SHA1
db042629b0d6dfe7281fcd773c51e7e9d2304a60
-
SHA256
1328d7628ec5aeeb2ed7489cc1a3b11a242018d30e073e530356f0c1756505ca
-
SHA512
7b9b234da3061431488e3ac24c5e2a9842e00c8c57fc19ff34a32c32cac32707a7c40f4ad2b1b835b23e43a2c74ccd78b127af737126f33ca3d961d3e31d121c
-
SSDEEP
768:JH2fEUrzSpNTGxJRo4ajA1/0BiqMw+iescZ7SzORRRMwRHrzPm3YTL3dU:QfFrixgaU1Zp7xvHzPm3YPdU
Score1/10 -
-
-
Target
malware/mprext.dll
-
Size
13KB
-
MD5
0eabd6ab464758f058fc039a47f61750
-
SHA1
51bc562a59e565e3f39a54e4c788896b8803354b
-
SHA256
f96e8d99b736e4ce7997bb1de65d88c32e16f1f725d8bd98f52c39a02969fd87
-
SHA512
f5a038615ecbb72072ef2a72d166cabbfd26aa879f28c911a26db71581cb8b93b7554b1cfa1517b063fdc5f942281e7d409e70c998b8273fe9ee6a0fc61a00fb
-
SSDEEP
192:t2sVilvoSG4X6ryFKdEwFQnuyfc38EcX6mWf3W:t7Vilvo74XAyOFQfc3U6mWf3W
Score1/10 -
-
-
Target
malware/msidle.dll
-
Size
11KB
-
MD5
b1c1bb1ef2ac2d739aeaed77c33c1848
-
SHA1
efa181a1ea01e02cd44614f80259ce794b7a455c
-
SHA256
cd8d7caebfeb4eb9124ba3e025aff68dde554a8dd6b3365654bf936200c4e563
-
SHA512
f4e24c508248e6f331aa16ed01c7cdc6cebbc4cd09dfa9f511d02544e2c04eb36c9480ae71d9ddef039a1e9d6e0324179a9ba0f1c323e20c4bbf813a154e2fc0
-
SSDEEP
192:PtHC6MRyx1TTmcWOznzYuhcGZtEclABY5Wx46QuW:g68yx13maLX1ZhAa5Wx46zW
Score1/10 -
-
-
Target
malware/msidntld.dll
-
Size
5KB
-
MD5
504e51418d856d664db23dd55a61352d
-
SHA1
522c0fb1ed2b9594e7a2aab9481883da57d8ca23
-
SHA256
f190e142f402de460455ff2d1835294a3e118ba74d76aa092af49372bb9b76f4
-
SHA512
28bebb26eeb8ba97fb0ac8cc4869576d3cc58cd7c0fdce988f6fe160c7b426c2a3906799ca021a65a26394cba266dfa3d3e58790ec41c7eb7ecd0fbd89d6e0db
-
SSDEEP
48:Cc9m3IIuHkvrQ5yHqO2JsYa3yBk2lFIZWxHtNukt685WwHg6ab:Rm4ZEvrU/bTaiy2HEWhtDdWw3
Score1/10 -