Overview
overview
10Static
static
5HTCTL32.dll
windows10-2004-x64
3HTCTL32.dll
windows11-ltsc_2024-x64
3PCICHEK.dll
windows10-2004-x64
3PCICHEK.dll
windows11-ltsc_2024-x64
3PCICL32.dll
windows10-2004-x64
3PCICL32.dll
windows11-ltsc_2024-x64
3TCCTL32.dll
windows10-2004-x64
3TCCTL32.dll
windows11-ltsc_2024-x64
3branding.dll
windows10-2004-x64
1branding.dll
windows11-ltsc_2024-x64
1client32.exe
windows10-2004-x64
10client32.exe
windows11-ltsc_2024-x64
10hw.dll
windows10-2004-x64
3hw.dll
windows11-ltsc_2024-x64
3msvcr100.dll
windows10-2004-x64
3msvcr100.dll
windows11-ltsc_2024-x64
3nkageh/avutil-59.dll
windows10-2004-x64
1nkageh/avutil-59.dll
windows11-ltsc_2024-x64
1nkageh/libopus-0.dll
windows10-2004-x64
1nkageh/libopus-0.dll
windows11-ltsc_2024-x64
1nkageh/lib...-1.dll
windows10-2004-x64
1nkageh/lib...-1.dll
windows11-ltsc_2024-x64
1nkajko/avutil-59.dll
windows10-2004-x64
1nkajko/avutil-59.dll
windows11-ltsc_2024-x64
1nkajko/libopus-0.dll
windows10-2004-x64
1nkajko/libopus-0.dll
windows11-ltsc_2024-x64
1nkajko/lib...-1.dll
windows10-2004-x64
1nkajko/lib...-1.dll
windows11-ltsc_2024-x64
1pcicapi.dll
windows10-2004-x64
3pcicapi.dll
windows11-ltsc_2024-x64
3remcmdstub.exe
windows10-2004-x64
3remcmdstub.exe
windows11-ltsc_2024-x64
3General
- Target rats.zip
- Size 6.1MB
- Sample260913-gzdsbssfla
- SHA256 f95fb9f3787981a2b4f3dd22badc13f0a32230da02d926abc5fe902c6050d984
- MD5 6ae89830f92c0c014b6a83c129063946
- SHA1 9b9c6b5d003179aa3c2d0119ccc2ee3c2a05aa29
- SHA512 612714b9513e90a09966c8f4a0faef6ac0f5ad8a1ea8a383cdc72eb2fc8ec4d255109095586c25228ec622c4937a4a4c98d91244aca663633b2135ea4f64c957
- SSDEEP 98304:/srKfaWGPd1BYAVq9q6sp3jp5svVPp5/vVvp5nvVQp5kvVhp5tvVE:Ur6GPDBgNsp3bsvR/v9nvckv3tvS
- TLSH T15256336E3CFE61846907E66386C4AEED29D75026BF016A3FCF185168F1F0BC562B0527
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
HTCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
PCICHEK.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
PCICHEK.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
PCICL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
PCICL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
TCCTL32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
TCCTL32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
branding.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
branding.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
client32.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
client32.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
hw.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
hw.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
msvcr100.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
msvcr100.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
nkageh/avutil-59.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
nkageh/avutil-59.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
nkageh/libopus-0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
nkageh/libopus-0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
nkageh/libwinpthread-1.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
nkageh/libwinpthread-1.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
nkajko/avutil-59.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
nkajko/avutil-59.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
nkajko/libopus-0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
nkajko/libopus-0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
nkajko/libwinpthread-1.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
nkajko/libwinpthread-1.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
pcicapi.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
pcicapi.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
remcmdstub.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
remcmdstub.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
- MD5 2d3b207c8a48148296156e5725426c7f
- SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
- SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
- SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
- TLSH T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
- MD5 a0b9388c5f18e27266a31f8c5765b263
- SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
- SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
- SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
- TLSH T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target PCICL32.DLL
- Size 3.6MB
- SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
- MD5 00587238d16012152c2e951a087f2cc9
- SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
- SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
- SSDEEP 49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
- TLSH T125060831E544CC72E156407ADC7DAADD41162DA00F1886EF398EB9692FF23C422F9E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target TCCTL32.DLL
- Size 387KB
- SHA256 6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
- MD5 eab603d12705752e3d268d86dff74ed4
- SHA1 01873977c871d3346d795cf7e3888685de9f0b16
- SHA512 77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
- SSDEEP 12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
- TLSH T118849E20BA40C13AF1D61075C6BCDFBA7DADB470176851CB6BD509BA4F582E2E63834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target branding.dll
- Size 50KB
- SHA256 214bb96e33fac6fa19f5c33f950267bf5d25507d0f78eee1707f16442eaecb5d
- MD5 624cc97b1a59cef7496378f35b2c80dc
- SHA1 7ccd976d8da0a7868a110bc017f5fc57272ba192
- SHA512 cf15a8c6612c5ec0161f76eddc8683baa17e85a78fecd21681a870c2e02b99ee088add5253aee83fe0f18d0b9d33de9d0215297d9a57175840fe2ab54c19089a
- SSDEEP 768:Qx/SWE1b2Rz9pYj9+Emxt1dRn1E1WZAw87jr++nnOYikdP3iPmbL:AqKRz9pYE1swiwZ7kdf7
- TLSH T18D338D4DBB47E829EDE77B32168C8B266769F520AE34CACD5110807DAE1F303265563E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target client32.exe
- Size 117KB
- SHA256 06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268
- MD5 ee75b57b9300aab96530503bfae8a2f2
- SHA1 98dd757e1c1fa8b5605bda892aa0b82ebefa1f07
- SHA512 660259bb0fd317c7fb76505da8cbc477e146615fec10e02779cd4f527aeb00caed833af72f90b128bb62f10326209125e809712d9acb41017e503126e5f85673
- SSDEEP 768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
- TLSH T1ECC3B34F469DE173EA42E97CC4819B050DA4BEC9B8B458FB005EF63E3E3178E2B5415A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
- Target hw.dll
- Size 1.6MB
- SHA256 be45f76049a133392423679d334c69c8e1e7e82dc873eebdd229ea0341ba1b10
- MD5 a74c64de593e2533c04200c5417bd9e9
- SHA1 f0f7372692f285154c76be35fc50b89ed0ea2d18
- SHA512 76ed60efd226aaf32788b27e878cca71560bc4a533d12b29cf22bd9d12a14e6dc26d831c2541fcf128dac46e7c539a65198fce36f1c7e99c21879aae3cd01ccf
- SSDEEP 49152:Pn5eTLq8KRr1h1naYZe2+h6yfQDnlRZJB1/2:BeUn1naYc2X7lPU
- TLSH T13C75AE225C0080B5D0A2927A14FFBB79E6BCDA55522697C3A3DCC8A94DE45F0731F39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target nkageh/avutil-59.dll
- Size 1006KB
- SHA256 2fae8b53478910826f8641184ec2c0ffa63c73565e17e9b486a69861f57fc70f
- MD5 e8563e16e5bb8a3bde41ed3ed063a3a2
- SHA1 b77df93eb95df871b7d0b2361a4df5722376e105
- SHA512 7cbe4ee6ba4faa084e8e78976df3a0a81d32f9de829d8b11c4430996a2c03b380a1ae392a967fa7b5f6c6b5f95736f28301b3278b7c1a057c8e1432edd981fc8
- SSDEEP 12288:qq8MhW0Cy+H0uN5kgNS4p8FPE+VSnGZnvABunBXR+CvqaM129:qj0Cp0uN5kgNS4p8FPEfnY4BuBwH8
- TLSH T1E6254C01A5E3546DC9AA913046EB7657B6313412CA60BE6F67A14D303F28F912ECFF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target nkageh/libopus-0.dll
- Size 408KB
- SHA256 ebb08f38d0585d734ec0ef3e5c9b504c8f3c11e4c9f0d5488e6dd4769c6b5c9b
- MD5 b806de8cbb754dda84e49c9ecb6ff68e
- SHA1 dd43063955dc79150197ad38f225fdd56d667251
- SHA512 604632e317c940a94c201071dbe546e7497f72690280461d1d806027e249718a1a4cad6f3c7d04e311bbb39e260ff3c3c1db00ad150d2f8ddd9eef8db3d56541
- SSDEEP 12288:zmSzvLHPWhDXXSLu8owrIpOS94tGi0zzO20w:fjLHPWhDOu870XX0
- TLSH T1AA947E45E6E398ACD167D074524BBB73EC30B41402286C775BE0CAB17EA7D505B8EB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target nkageh/libwinpthread-1.dll
- Size 54KB
- SHA256 1ffa354ea28e261ca2c5b313237c28f74e88595a1270c2c9cae93eb34673ce79
- MD5 d114eaca35d3b9061023967b6ba192ea
- SHA1 54088c580e172da769b93df6f87197eed589509b
- SHA512 85a71f66a2f4656f2852f5968ef5ae4c5befea4a55a8d6e8fd1f78f858d59c37d789630d83ab36071d8448e0fc5339c042e39ae1c8572e36e95d9db1c65e29f9
- SSDEEP 768:qH2fEUrzSpNTGxJRo4ajA1/0BiqMw+iescZ7SzORRRMwRHrzPm3YTL3dU:3fFrixgaU1Zp7xvHzPm3YPdU
- TLSH T10843294F326690FCC54AC53044FB82315A33F82416655F2EA378EF762E98E269F1ED58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target nkajko/avutil-59.dll
- Size 1006KB
- SHA256 2fae8b53478910826f8641184ec2c0ffa63c73565e17e9b486a69861f57fc70f
- MD5 e8563e16e5bb8a3bde41ed3ed063a3a2
- SHA1 b77df93eb95df871b7d0b2361a4df5722376e105
- SHA512 7cbe4ee6ba4faa084e8e78976df3a0a81d32f9de829d8b11c4430996a2c03b380a1ae392a967fa7b5f6c6b5f95736f28301b3278b7c1a057c8e1432edd981fc8
- SSDEEP 12288:qq8MhW0Cy+H0uN5kgNS4p8FPE+VSnGZnvABunBXR+CvqaM129:qj0Cp0uN5kgNS4p8FPEfnY4BuBwH8
- TLSH T1E6254C01A5E3546DC9AA913046EB7657B6313412CA60BE6F67A14D303F28F912ECFF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target nkajko/libopus-0.dll
- Size 408KB
- SHA256 ebb08f38d0585d734ec0ef3e5c9b504c8f3c11e4c9f0d5488e6dd4769c6b5c9b
- MD5 b806de8cbb754dda84e49c9ecb6ff68e
- SHA1 dd43063955dc79150197ad38f225fdd56d667251
- SHA512 604632e317c940a94c201071dbe546e7497f72690280461d1d806027e249718a1a4cad6f3c7d04e311bbb39e260ff3c3c1db00ad150d2f8ddd9eef8db3d56541
- SSDEEP 12288:zmSzvLHPWhDXXSLu8owrIpOS94tGi0zzO20w:fjLHPWhDOu870XX0
- TLSH T1AA947E45E6E398ACD167D074524BBB73EC30B41402286C775BE0CAB17EA7D505B8EB3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target nkajko/libwinpthread-1.dll
- Size 54KB
- SHA256 1ffa354ea28e261ca2c5b313237c28f74e88595a1270c2c9cae93eb34673ce79
- MD5 d114eaca35d3b9061023967b6ba192ea
- SHA1 54088c580e172da769b93df6f87197eed589509b
- SHA512 85a71f66a2f4656f2852f5968ef5ae4c5befea4a55a8d6e8fd1f78f858d59c37d789630d83ab36071d8448e0fc5339c042e39ae1c8572e36e95d9db1c65e29f9
- SSDEEP 768:qH2fEUrzSpNTGxJRo4ajA1/0BiqMw+iescZ7SzORRRMwRHrzPm3YTL3dU:3fFrixgaU1Zp7xvHzPm3YPdU
- TLSH T10843294F326690FCC54AC53044FB82315A33F82416655F2EA378EF762E98E269F1ED58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target pcicapi.dll
- Size 32KB
- SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
- MD5 dcde2248d19c778a41aa165866dd52d0
- SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
- SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
- SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
- TLSH T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target remcmdstub.exe
- Size 75KB
- SHA256 6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6
- MD5 1768c9971cea4cc10c7dd45a5f8f022a
- SHA1 3d199bee412cbac0a6d2c4c9fd5509ad12a667e7
- SHA512 f83bf23abce316cb1b91a0ac89c1a709a58a7ec49c8493140ad7dc7a629e8f75032057889e42be3091cf351760348380634f660c47a3897f69e398849ca46780
- SSDEEP 1536:SfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/wjHnee/ssjHai:kafLSpAFUzt0LLIywYehjHeyjH
- TLSH T1D6738E163A65C033EA424D3464F8D6635E7EB96349F9908BBB58077D1FA03C06F6873A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10