netsupport | af218d3dc42ab39fef2c0780450851b67eaac698f616a76b8c169e347b1f02d0 | Triage™

Login
Reports

Overview

overview

Static

static

5

HTCTL32.dll

windows10-2004-x64

3

HTCTL32.dll

windows11-21h2-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICHEK.dll

windows11-21h2-x64

3

PCICL32.dll

windows10-2004-x64

3

PCICL32.dll

windows11-21h2-x64

3

TCCTL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows11-21h2-x64

3

client32.exe

windows10-2004-x64

client32.exe

windows11-21h2-x64

gehsfe/msvcp120.dll

windows10-2004-x64

3

gehsfe/msvcp120.dll

windows11-21h2-x64

3

gehsfe/vpnclient.dll

windows10-2004-x64

3

gehsfe/vpnclient.dll

windows11-21h2-x64

3

mirres/msvcp120.dll

windows10-2004-x64

3

mirres/msvcp120.dll

windows11-21h2-x64

3

mirres/vpnclient.dll

windows10-2004-x64

3

mirres/vpnclient.dll

windows11-21h2-x64

3

msvcr100.dll

windows10-2004-x64

3

msvcr100.dll

windows11-21h2-x64

3

pcicapi.dll

windows10-2004-x64

3

pcicapi.dll

windows11-21h2-x64

3

remcmdstub.exe

windows10-2004-x64

3

remcmdstub.exe

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
osxs.zip
Size 2.9MB
Sample260604-pkbcnaew2s
SHA256 af218d3dc42ab39fef2c0780450851b67eaac698f616a76b8c169e347b1f02d0
MD5 8e97f650e2809304ae02e6e5f8c0c44b
SHA1 8a6e278d4d75cb145859229223b225ce39773e05
SHA512 7b3b46a1b75aac114c31347f786dc3c17ea4e5968f3792ef9d79fb59edfc7ea859604182b3c556be5ef84b199edab050aa05b1ebcab04ee48715dc3116fa3cef
SSDEEP 49152:/sz83O/Kfa2rjGE8pd1BFSlesjAVqkguo9i6IzQ6eGs0e1Q6UGs04:/srKfaWGPd1BYAVq3Vas0Us04
TLSH
T1C4D533DBE4955249E638DBBBECC8BB198165840A3D9ADC33DD24F644C2DF7A00B24637
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

netsupport discovery rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

HTCTL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

HTCTL32.dll

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

PCICHEK.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

PCICHEK.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

PCICL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

PCICL32.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

TCCTL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

TCCTL32.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

client32.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral10

Sample

client32.exe

Resource

win11-20260513-en

windows11-21h2-x64

4 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral11

Sample

gehsfe/msvcp120.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

gehsfe/msvcp120.dll

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

gehsfe/vpnclient.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

gehsfe/vpnclient.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

mirres/msvcp120.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

mirres/msvcp120.dll

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

mirres/vpnclient.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

mirres/vpnclient.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

msvcr100.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

msvcr100.dll

Resource

win11-20260513-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

pcicapi.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

pcicapi.dll

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

remcmdstub.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

remcmdstub.exe

Resource

win11-20260513-en

windows11-21h2-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
- MD5 2d3b207c8a48148296156e5725426c7f
- SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
- SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
- SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
- TLSH
  T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
- MD5 a0b9388c5f18e27266a31f8c5765b263
- SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
- SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
- SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
- TLSH
  T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  PCICL32.DLL
- Size 3.6MB
- SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
- MD5 00587238d16012152c2e951a087f2cc9
- SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
- SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
- SSDEEP 49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
- TLSH
  T125060831E544CC72E156407ADC7DAADD41162DA00F1886EF398EB9692FF23C422F9E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  TCCTL32.DLL
- Size 387KB
- SHA256 6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
- MD5 eab603d12705752e3d268d86dff74ed4
- SHA1 01873977c871d3346d795cf7e3888685de9f0b16
- SHA512 77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
- SSDEEP 12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
- TLSH
  T118849E20BA40C13AF1D61075C6BCDFBA7DADB470176851CB6BD509BA4F582E2E63834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  client32.exe
- Size 117KB
- SHA256 06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268
- MD5 ee75b57b9300aab96530503bfae8a2f2
- SHA1 98dd757e1c1fa8b5605bda892aa0b82ebefa1f07
- SHA512 660259bb0fd317c7fb76505da8cbc477e146615fec10e02779cd4f527aeb00caed833af72f90b128bb62f10326209125e809712d9acb41017e503126e5f85673
- SSDEEP 768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
- TLSH
  T1ECC3B34F469DE173EA42E97CC4819B050DA4BEC9B8B458FB005EF63E3E3178E2B5415A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral10 behavioral9
- Target
  gehsfe/msvcp120.dll
- Size 434KB
- SHA256 a4df31ca93df5bf27c5a7107accb83ad7af58a3d313750f30322e9c10c0266eb
- MD5 101fe64acfe08e1137cafc5a91166b3c
- SHA1 6b30afd105037cc96c822bb61da19a1ec4ceb3f6
- SHA512 adce03266afd5944b2ca36d5f3c9292e2b33cea02dc48b7c1368877fdc1fe84d289c4652ba66c6b0d30c09170d1e8854bbd81ebe95d1efc6363008f416b21789
- SSDEEP 12288:GZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77X:+/8wVwHZFTwFOOos3Ooc8DHkC2e77X
- TLSH
  T10A944A237B864CF2D19E53B231C9532557FABC2541B1E343ABEEE1693FA5282E123611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  gehsfe/vpnclient.dll
- Size 375KB
- SHA256 e33627992f7a338937383d4c42dbb1d1928c6f7d1d0b94df2b24037d11446418
- MD5 7f37a688a3cf8ab97487d9f1afaa0c31
- SHA1 00c132b7c7f683d934679846e84d8fe8000ea009
- SHA512 fb5db12cc6d58013c3a0fdac5db95bf3db678993a55f464ccb5565636094d70152d2cca6f9045f8e1793d76595d578adff87f95348e37ff48d529da6280f70fb
- SSDEEP 6144:q5nrC4GMwi56tl2pvYTeYbNEX6lbEAGotig5QcXNMcPUmj7Ie2l:V4GRi0/UGPNEKtQ9
- TLSH
  T1B784BE11F441C032D89E0634B478EBBE593DA6601F3690C7E7985E7E6E206C3AB35A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  mirres/msvcp120.dll
- Size 434KB
- SHA256 a4df31ca93df5bf27c5a7107accb83ad7af58a3d313750f30322e9c10c0266eb
- MD5 101fe64acfe08e1137cafc5a91166b3c
- SHA1 6b30afd105037cc96c822bb61da19a1ec4ceb3f6
- SHA512 adce03266afd5944b2ca36d5f3c9292e2b33cea02dc48b7c1368877fdc1fe84d289c4652ba66c6b0d30c09170d1e8854bbd81ebe95d1efc6363008f416b21789
- SSDEEP 12288:GZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77X:+/8wVwHZFTwFOOos3Ooc8DHkC2e77X
- TLSH
  T10A944A237B864CF2D19E53B231C9532557FABC2541B1E343ABEEE1693FA5282E123611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  mirres/vpnclient.dll
- Size 375KB
- SHA256 e33627992f7a338937383d4c42dbb1d1928c6f7d1d0b94df2b24037d11446418
- MD5 7f37a688a3cf8ab97487d9f1afaa0c31
- SHA1 00c132b7c7f683d934679846e84d8fe8000ea009
- SHA512 fb5db12cc6d58013c3a0fdac5db95bf3db678993a55f464ccb5565636094d70152d2cca6f9045f8e1793d76595d578adff87f95348e37ff48d529da6280f70fb
- SSDEEP 6144:q5nrC4GMwi56tl2pvYTeYbNEX6lbEAGotig5QcXNMcPUmj7Ie2l:V4GRi0/UGPNEKtQ9
- TLSH
  T1B784BE11F441C032D89E0634B478EBBE593DA6601F3690C7E7985E7E6E206C3AB35A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  pcicapi.dll
- Size 32KB
- SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
- MD5 dcde2248d19c778a41aa165866dd52d0
- SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
- SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
- SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
- TLSH
  T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  remcmdstub.exe
- Size 75KB
- SHA256 6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6
- MD5 1768c9971cea4cc10c7dd45a5f8f022a
- SHA1 3d199bee412cbac0a6d2c4c9fd5509ad12a667e7
- SHA512 f83bf23abce316cb1b91a0ac89c1a709a58a7ec49c8493140ad7dc7a629e8f75032057889e42be3091cf351760348380634f660c47a3897f69e398849ca46780
- SSDEEP 1536:SfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/wjHnee/ssjHai:kafLSpAFUzt0LLIywYehjHeyjH
- TLSH
  T1D6738E163A65C033EA424D3464F8D6635E7EB96349F9908BBB58077D1FA03C06F6873A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

discoverynetsupportrat

behavioral10

discoverynetsupportrat

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

© 2018-2026

Terms | Privacy