Overview

overview

10

Static

static

3

AudioCapture.dll

windows10-2004-x64

3

AudioCapture.dll

windows11-21h2-x64

3

HTCTL32.dll

windows10-2004-x64

3

HTCTL32.dll

windows11-21h2-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICHEK.dll

windows11-21h2-x64

3

PCICL32.dll

windows10-2004-x64

3

PCICL32.dll

windows11-21h2-x64

3

TCCTL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows11-21h2-x64

3

msvcr100.dll

windows10-2004-x64

3

msvcr100.dll

windows11-21h2-x64

3

neservice.exe

windows10-2004-x64

10

neservice.exe

windows11-21h2-x64

10

ns/AudioCapture.dll

windows10-2004-x64

3

ns/AudioCapture.dll

windows11-21h2-x64

3

ns/HTCTL32.dll

windows10-2004-x64

3

ns/HTCTL32.dll

windows11-21h2-x64

3

ns/PCICHEK.dll

windows10-2004-x64

3

ns/PCICHEK.dll

windows11-21h2-x64

3

ns/PCICL32.dll

windows10-2004-x64

3

ns/PCICL32.dll

windows11-21h2-x64

3

ns/TCCTL32.dll

windows10-2004-x64

3

ns/TCCTL32.dll

windows11-21h2-x64

3

ns/msvcr100.dll

windows10-2004-x64

3

ns/msvcr100.dll

windows11-21h2-x64

3

ns/neservice.exe

windows10-2004-x64

10

ns/neservice.exe

windows11-21h2-x64

10

ns/pcicapi.dll

windows10-2004-x64

3

ns/pcicapi.dll

windows11-21h2-x64

3

ns/remcmdstub.exe

windows10-2004-x64

3

ns/remcmdstub.exe

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    at.7z
  • Size 2.9MB
  • Sample260302-slbatsez3f
  • SHA256 c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target
      AudioCapture.dll
    • Size 87KB
    • SHA256 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      HTCTL32.DLL
    • Size 316KB
    • SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      PCICHEK.DLL
    • Size 14KB
    • SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      PCICL32.DLL
    • Size 3.3MB
    • SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      TCCTL32.DLL
    • Size 378KB
    • SHA256 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      msvcr100.dll
    • Size 755KB
    • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      neservice.exe
    • Size 117KB
    • SHA256 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverynetsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport
    behavioral13behavioral14
    • Target
      ns/AudioCapture.dll
    • Size 87KB
    • SHA256 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      ns/HTCTL32.DLL
    • Size 316KB
    • SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      ns/PCICHEK.DLL
    • Size 14KB
    • SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      ns/PCICL32.DLL
    • Size 3.3MB
    • SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      ns/TCCTL32.DLL
    • Size 378KB
    • SHA256 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      ns/msvcr100.dll
    • Size 755KB
    • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      ns/neservice.exe
    • Size 117KB
    • SHA256 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverynetsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport
    behavioral27behavioral28
    • Target
      ns/pcicapi.dll
    • Size 106KB
    • SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      ns/remcmdstub.exe
    • Size 58KB
    • SHA256 b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discoverynetsupportrat
Score
10/10

behavioral14

discoverynetsupportrat
Score
10/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discoverynetsupportrat
Score
10/10

behavioral28

discoverynetsupportrat
Score
10/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10