netsupport | e8a09ba78c64707dac90a75c6b775189254963b57b5c319e6ce28f7e9879ae1f | Triage™

Login
Reports

Overview

overview

Static

static

5

AudioCapture.dll

windows10-2004-x64

3

AudioCapture.dll

windows11-ltsc_2024-x64

3

HTCTL32.dll

windows10-2004-x64

3

HTCTL32.dll

windows11-ltsc_2024-x64

3

NSM.lic

windows10-2004-x64

3

NSM.lic

windows11-ltsc_2024-x64

3

NSM.ini

windows10-2004-x64

1

NSM.ini

windows11-ltsc_2024-x64

1

PCICHEK.dll

windows10-2004-x64

3

PCICHEK.dll

windows11-ltsc_2024-x64

3

PCICL32.dll

windows10-2004-x64

3

PCICL32.dll

windows11-ltsc_2024-x64

3

TCCTL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows11-ltsc_2024-x64

3

client32.exe

windows10-2004-x64

client32.exe

windows11-ltsc_2024-x64

client32.ini

windows10-2004-x64

1

client32.ini

windows11-ltsc_2024-x64

1

msvcr100.dll

windows10-2004-x64

3

msvcr100.dll

windows11-ltsc_2024-x64

3

nskbfltr.inf

windows10-2004-x64

1

nskbfltr.inf

windows11-ltsc_2024-x64

1

nsm_vpro.ini

windows10-2004-x64

1

nsm_vpro.ini

windows11-ltsc_2024-x64

1

pcicapi.dll

windows10-2004-x64

3

pcicapi.dll

windows11-ltsc_2024-x64

3

remcmdstub.exe

windows10-2004-x64

3

remcmdstub.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
remcmdstub.zip
Size 2.2MB
Sample260810-3ahkwabb54
SHA256 e8a09ba78c64707dac90a75c6b775189254963b57b5c319e6ce28f7e9879ae1f
MD5 f7e84c37b1aea16a1e80baf6c72840bc
SHA1 82b5b538ea17a4cd93173ac83a42cd27d7a90cee
SHA512 66aef3a4f2019ba952d7a41882d073f1b062d28e7c127abae31a1600106889032dcc5a7c3b180391faeb4465349ba0e8258ca706835ec0f443a263a0b50d9e7e
SSDEEP 49152:gsZQdMtsL3HYZuchzlRsXwlKsaFnTT7Ejujwk/wGZ1f0ZjkJGwPVuJRD:geQdMuoochzQXwlSTQju0k/wGvYk8wip
TLSH
T10FB533E6CD7C6E9C744DB4392EF8093403B29F97B941BC6436B28207ADD9CD92F01566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

netsupport discovery execution ransomware rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

AudioCapture.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

AudioCapture.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

HTCTL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

HTCTL32.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

NSM.lic

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

NSM.lic

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

NSM.ini

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

NSM.ini

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

PCICHEK.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

PCICHEK.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

PCICL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

PCICL32.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

TCCTL32.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

TCCTL32.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

client32.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

4 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral16

Sample

client32.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral17

Sample

client32.ini

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

client32.ini

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

msvcr100.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

msvcr100.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

nskbfltr.inf

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

nskbfltr.inf

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

nsm_vpro.ini

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

nsm_vpro.ini

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

pcicapi.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

pcicapi.dll

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

remcmdstub.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

remcmdstub.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  AudioCapture.dll
- Size 91KB
- SHA256 a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8
- MD5 4182f37b9ba1fa315268c669b5335dde
- SHA1 2c13da0c10638a5200fed99dcdcf0dc77a599073
- SHA512 4f22ad5679a844f6ed248bf2594af94cf2ed1e5c6c5441f0fb4de766648c17d1641a6ce7c816751f0520a3ae336479c15f3f8b6ebe64a76c38bc28a02ff0f5dc
- SSDEEP 1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI
- TLSH
  T1EA936C103885C037F59748BBC9FAC6594E3E79944B6591DF3BC802A98F627E29F39207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  HTCTL32.DLL
- Size 320KB
- SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- MD5 c94005d2dcd2a54e40510344e0bb9435
- SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP 6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
- TLSH
  T117646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  NSM.LIC
- Size 262B
- SHA256 88448fa440aeaff2b4c43f9daca92f9948e32d1e42e822695902a870a23173bc
- MD5 35b4ea845eb5d44743a5e68ad8f24c91
- SHA1 4109e52c70a3d3749207d7b48d632f044bbc090d
- SHA512 b47f8bc0dcb99de187f09cfd79a15f0c3ed59b36df088c0ffb36b6970759511ef93cd868693f727c2a9ac043b3721c127f1b494c45a246c90c1fc038409b96fa
- TLSH
  T190D02BC59212101783D15151BF9AA8AE92C8B014C2E86854FAF91B662EA54201ACD45C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  NSM.ini
- Size 6KB
- SHA256 60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92
- MD5 88b1dab8f4fd1ae879685995c90bd902
- SHA1 3d23fb4036dc17fa4bee27e3e2a56ff49beed59d
- SHA512 4ea2c20991189fe1d6d5c700603c038406303cca594577ddcbc16ab9a7915cb4d4aa9e53093747db164f068a7ba0f568424bc8cb7682f1a3fb17e4c9ec01f047
- SSDEEP 96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
- TLSH
  T123D1FD82234B43B154763755DBF6B8F5CB25095E46B36421B2AE4C4E13BA836C38B0FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  PCICHEK.DLL
- Size 18KB
- SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- MD5 104b30fef04433a2d2fd1d5f99f179fe
- SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP 192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
- TLSH
  T12A8218D21F686143EBE38E70A5EAD7165D36B6D09B7481EF307981452EC0BE03E6871E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  PCICL32.DLL
- Size 3.6MB
- SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- MD5 d3d39180e85700f72aaae25e40c125ff
- SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
- TLSH
  T134060832E548CC71D156407AEC7DAADD45162DA00F1981EF3A8DB9692EF23C432F8E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  TCCTL32.DLL
- Size 387KB
- SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- MD5 2c88d947a5794cf995d2f465f1cb9d10
- SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP 12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
- TLSH
  T175849E20BA40C139F1D61174C6BCEFBA7DADB870176851CB6BD509BA4F582D2E63834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  client32.exe
- Size 121KB
- SHA256 06b293ab4070517c3d7afdf31134049f1fb7bc50ca10277d7cd2aa7c712ae39f
- MD5 a730529e0b2322b12d8c6cbcf038acc5
- SHA1 0be926d747a77b741d344487ae1ea9522dd5411b
- SHA512 4fe48c1f84725b25c3434f7659afffa378a3082ef22680d8a92d8edc161bd2b074db3a8c849eb308724069930efd630b0aac6a2dc819a329f9d0e2ea5e129311
- SSDEEP 768:8EVZl6FhWr80/FKCr2bhuj/TV+wnAr2bhuCRQTV+wG:8G0hGNKS2hujEwnw2huGlwG
- TLSH
  T133C3C44F4299A073EB42DA7DD8859B050C60BDC9B9F458FB505EF23E3E3178E2B6405A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral15 behavioral16
- Target
  client32.ini
- Size 766B
- SHA256 13ba6a1dde5acd29e7e7e93862d9f2e22ad5f692d9a9ae6bb33bca347ab5d7f3
- MD5 1d327fbe198d1409f66319b46fe0831b
- SHA1 da3c781bdef266d96c5e5f043daee2abb35773d8
- SHA512 195bf40670feb15f9696aa80c57a5def16fec10cf9ee0b5eaba2dcf4ce812579fec3a55ee08b650e9cacd66480de0d6e6afd771f8af937ddb2da4cc682a2411f
- TLSH
  T15E01B812234BBE9C199BF2C2BAF441D01FE34041E56E751196086D6E4F32A7D099F891
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral17 behavioral18
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  nskbfltr.inf
- Size 328B
- SHA256 d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
- MD5 26e28c01461f7e65c402bdf09923d435
- SHA1 1d9b5cfcc30436112a7e31d5e4624f52e845c573
- SHA512 c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7
- TLSH
  T147E0260E4C8292345B93769A631349A293B40060D8B60A4034EB4A35314F08F028A1BF
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral21 behavioral22
- Target
  nsm_vpro.ini
- Size 46B
- SHA256 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
- MD5 3be27483fdcdbf9ebae93234785235e3
- SHA1 360b61fe19cdc1afb2b34d8c25d8b88a4c843a82
- SHA512 edbe8cf1cbc5fed80fedf963ade44e08052b19c064e8bca66fa0fe1b332141fbe175b8b727f8f56978d1584baaf27d331947c0b3593aaff5632756199dc470e5
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral23 behavioral24
- Target
  pcicapi.dll
- Size 32KB
- SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- MD5 34dfb87e4200d852d1fb45dc48f93cfc
- SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
- TLSH
  T1AEE27EC59A98A493F9C94C7570EEEB335C3D76B0675500D3B2A682A91ED83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  remcmdstub.exe
- Size 79KB
- SHA256 cfde8fa7df7f25a541ee9d0c4b2fa4156adf1a2d022ac1665b087c67ddc457f0
- MD5 f2db0efff905b9874c5a5c359c815557
- SHA1 cad494fee08cb536714ed1ce680ebea1bb8b57e1
- SHA512 18a15c5b34b7c7ae4c6ff69cdad1b5b8c8aa018efbe1fc68c60cf4767ec3f630ef19b021be790a0b2008e580456f680c2a86cc3c05c3ec3921b6f38adbeea901
- SSDEEP 1536:1fafvTuNOwphKuyUHTqYXHhrXH45LIybGoG2hu0zwOCT2hu5wV:1afLSpAFUzt05LIybaqwOCT5wV
- TLSH
  T185837C163A65C033EE424D7864F8D1735E7DBDA35AF9808BBB59066D1E903C12F6833A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

discoverynetsupportrat

behavioral16

discoverynetsupportrat

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

© 2018-2026

Terms | Privacy