netsupport | bb88fec74a275024becac2fac14510b754b87979cdea0f79331516ef1f893a31 | Triage™

Login
Reports

Overview

overview

Static

static

3

pw-ilil/Au...re.dll

windows10-2004-x64

3

pw-ilil/Au...re.dll

windows11-21h2-x64

3

pw-ilil/HTCTL32.dll

windows10-2004-x64

3

pw-ilil/HTCTL32.dll

windows11-21h2-x64

3

pw-ilil/PCICHEK.dll

windows10-2004-x64

3

pw-ilil/PCICHEK.dll

windows11-21h2-x64

3

pw-ilil/PCICL32.dll

windows10-2004-x64

3

pw-ilil/PCICL32.dll

windows11-21h2-x64

3

pw-ilil/TCCTL32.dll

windows10-2004-x64

3

pw-ilil/TCCTL32.dll

windows11-21h2-x64

3

pw-ilil/msvcr100.dll

windows10-2004-x64

3

pw-ilil/msvcr100.dll

windows11-21h2-x64

3

pw-ilil/pcicapi.dll

windows10-2004-x64

3

pw-ilil/pcicapi.dll

windows11-21h2-x64

3

pw-ilil/re...ub.exe

windows10-2004-x64

3

pw-ilil/re...ub.exe

windows11-21h2-x64

3

pw-ilil/service.exe

windows10-2004-x64

pw-ilil/service.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
bb88fec74a275024becac2fac14510b754b87979cdea0f79331516ef1f893a31.bin
Size 2.1MB
Sample260418-mvb1tsfz5t
SHA256 bb88fec74a275024becac2fac14510b754b87979cdea0f79331516ef1f893a31
MD5 80f6b011ef9593998a508d9d39a9c95c
SHA1 79ade6fb255a96355481b562415a20d6919cd365
SHA512 ff06f84fe4f73f4688a35355de4342e34f3d67dde14cf1076bcec888787d2d9340e4dbcbbad60680511e28a5ada209c6605c730ccf6216448d27ba5feb97ec3b
SSDEEP 49152:5YWKcquaxYrp7Bn+VnJTmm3F+WVcBdj3b2+3bw/0JBAThAnl1N9t:5DquCS1+/VYj3b2+30/wB/Vt
TLSH
T1A4A5339A9A0D88DFC55B4F74C00B5E1AD33E3A41F1AE7081F6728252CC89B9F57B8719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

netsupport discovery rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

pw-ilil/AudioCapture.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

pw-ilil/AudioCapture.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

pw-ilil/HTCTL32.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

pw-ilil/HTCTL32.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

pw-ilil/PCICHEK.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

pw-ilil/PCICHEK.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

pw-ilil/PCICL32.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

pw-ilil/PCICL32.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

pw-ilil/TCCTL32.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

pw-ilil/TCCTL32.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

pw-ilil/msvcr100.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

pw-ilil/msvcr100.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

pw-ilil/pcicapi.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

pw-ilil/pcicapi.dll

Resource

win11-20260130-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

pw-ilil/remcmdstub.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral16

Sample

pw-ilil/remcmdstub.exe

Resource

win11-20260130-en

windows11-21h2-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

pw-ilil/service.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

4 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral18

Sample

pw-ilil/service.exe

Resource

win11-20260130-en

windows11-21h2-x64

4 signatures

150 seconds

discovery netsupport rat

Malware Config

Targets

- Target
  pw-ilil/AudioCapture.dll
- Size 87KB
- SHA256 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
- MD5 7629af8099b76f85d37b3802041503ee
- SHA1 f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0
- SHA512 c209714ffdb0b95595583976340f2eb901eb9895f2f420afc4ca3c12744432e52fbedfd857b56cb347d4475df7678bd42d43f221208a108384e1df5aaf7d19e4
- SSDEEP 768:ZrOxYZwDgyfoVD/Ksdl0R8rKZEmU2ffE7CdmW1B1jvmhxccp2UvHNORpPePtJPv4:ZrOxDJs/Ksdl0R1dBmhFJERpPyJPvuXR
- TLSH
  T1F7936C203880C037F59748BBC9FAD6594A7E79544F6591DF7BC806A98F227D29F38207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  pw-ilil/HTCTL32.DLL
- Size 316KB
- SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
- MD5 051cdb6ac8e168d178e35489b6da4c74
- SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
- SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
- SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
- TLSH
  T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  pw-ilil/PCICHEK.DLL
- Size 14KB
- SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
- MD5 3aabcd7c81425b3b9327a2bf643251c6
- SHA1 ea841199baa7307280fc9e4688ac75e5624f2181
- SHA512 97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
- SSDEEP 192:uuYr6062b6Z1HVF6RRHXPPr+13fnYe+PjPIrI9FlP4r9ZCspE+TMlr78Vkf:uuYe72u6r+5nYPL7NheMr
- TLSH
  T1D562F7835BB41015EAE38FB15AF7C2565E36B7916FB4D1EF1190418A2E84FE02E2531B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  pw-ilil/PCICL32.DLL
- Size 3.3MB
- SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
- MD5 e7b92529ea10176fe35ba73fa4edef74
- SHA1 fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
- SHA512 fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
- SSDEEP 49152:FwWtZSlgPoqxyszApD0Ew0J94KinCgqGBQTdTBOHa3clSToWZiwDA:FwWrSlgHyszApD090mCgqTUSPE9
- TLSH
  T19EF51832E5048872E1564079DC7D6AEC451A6DA00F1881EF798EF9AD2EF23D533B4F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  pw-ilil/TCCTL32.DLL
- Size 378KB
- SHA256 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299
- MD5 1e6e804ca71eaf5bef0abef95c578cf0
- SHA1 8eb7e6eff15edcb01d20322c4994512fdd1dd227
- SHA512 197b782efa21ac87a54d3e63f90a75d80d70a30bfd686d29ed36ede79328db2aef58c8b242906bf7a6c9c0b33b8fa5f0ef23e541bb0d5c0786481bdcce191061
- SSDEEP 6144:bn452GF6HWSJkgGjMTUjemzWz+ZsYRtFM2V3KZ/aDVpIxNc+KT5Ev7pt0AUazmgt:D452GF6HlkgGjMT8emzWusytFMKDXIxj
- TLSH
  T14284AF20BA41C131F5DA1174C6BCEFB56D7EB471172891CBABD608FA5F146D2AA3830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  pw-ilil/msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  pw-ilil/pcicapi.dll
- Size 106KB
- SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
- MD5 67c53a770390e8c038060a1921c20da9
- SHA1 49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
- SHA512 201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
- SSDEEP 1536:LnzOfAUs8aONOb2H4NECHnTXg05rQMb2bbaPrw6BkJElFBIboKKGQ1w:LnSfAB8cb2YN7pSy8AuElFBIboKKGSw
- TLSH
  T1EFB38D01B192C5B2F5CA497806CB6B774F3D76A17E2450D3AB60D9810E7A7B37B1E20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  pw-ilil/remcmdstub.exe
- Size 58KB
- SHA256 b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2
- MD5 5be6fb8f28544d4f83c25a2b76ff7890
- SHA1 6ad5d9338984c52b37f2176c8ae4ae2366a7fd25
- SHA512 7635fc41dd7be6a55d944db7790e31fd607bfdc67845185facd52bcda24da139c5ba4fe0292ead097eaa606ed53fcfd2ce96c2fb7a15f3aba5fe7262e8041028
- SSDEEP 1536:Uf6nvXuNcAjJMBUHYBlXU1wT2JFqywsQ:e6nPcjJ4U4I1jFqywL
- TLSH
  T112435B167655D033E842093019B8D2B28E7B793356B5C49F7FA807BA4FF17D06A2837A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  pw-ilil/service.exe
- Size 33KB
- SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
- MD5 5a24676210bd317520fe30d048c9a106
- SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
- SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
- SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
- TLSH
  T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

discoverynetsupportrat

behavioral18

discoverynetsupportrat

© 2018-2026

Terms | Privacy