netsupport | 06aa951ad5384f9af7cbfa10692181cf622effa8d3840d62e3c1f37072465c04 | Triage™

Login
Reports

Overview

overview

Static

static

3

AudioCapture.dll

windows10-2004-x64

3

AudioCapture.dll

windows11-ltsc_2024-x64

3

CKSINI.exe

windows10-2004-x64

3

CKSINI.exe

windows11-ltsc_2024-x64

3

HTCTL32.dll

windows10-2004-x64

3

HTCTL32.dll

windows11-ltsc_2024-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICHEK.dll

windows11-ltsc_2024-x64

3

PCICL32.dll

windows10-2004-x64

3

PCICL32.dll

windows11-ltsc_2024-x64

3

Service.exe

windows10-2004-x64

Service.exe

windows11-ltsc_2024-x64

TCCTL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows11-ltsc_2024-x64

3

msvcr100.dll

windows10-2004-x64

3

msvcr100.dll

windows11-ltsc_2024-x64

3

pcicapi.dll

windows10-2004-x64

3

pcicapi.dll

windows11-ltsc_2024-x64

3

remcmdstub.exe

windows10-2004-x64

3

remcmdstub.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
nsm-portable.zip
Size 2.2MB
Sample261021-wq1casex2w
SHA256 06aa951ad5384f9af7cbfa10692181cf622effa8d3840d62e3c1f37072465c04
MD5 1a923a6fe7d5dde116383b59106f4796
SHA1 ffefdcd6696e1706fbd5d26e3a38895a73633e9a
SHA512 f4f961f22dc84a37a4067889b6253f96cba7986140c1405a6706ac0de2ff9e98897d34c41d7f969fd85be28bfd537771c4e8b124de05a3fc42d51875c3a9ea58
SSDEEP 49152:4cdip/jLhXosQSlkyEV0uL8hgvEb9PGBH4PZTCSlCsjIzuKEfbxlEDThXBJOhHb:4cKjLhXN5kJVqgvkQBHyU1yJAFXaR
TLSH
T166B533B398A7920BFD00D9FACDAF83C96B1F425054BE6AED0136C95F543AD80E2C9547
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

netsupport discovery rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

AudioCapture.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

AudioCapture.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

CKSINI.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

CKSINI.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

HTCTL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

HTCTL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

PCICHEK.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

PCICHEK.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

PCICL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

PCICL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

Service.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral12

Sample

Service.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral13

Sample

TCCTL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

TCCTL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

msvcr100.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

msvcr100.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

pcicapi.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

pcicapi.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

remcmdstub.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

remcmdstub.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  AudioCapture.dll
- Size 87KB
- SHA256 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
- MD5 7629af8099b76f85d37b3802041503ee
- SHA1 f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0
- SHA512 c209714ffdb0b95595583976340f2eb901eb9895f2f420afc4ca3c12744432e52fbedfd857b56cb347d4475df7678bd42d43f221208a108384e1df5aaf7d19e4
- SSDEEP 768:ZrOxYZwDgyfoVD/Ksdl0R8rKZEmU2ffE7CdmW1B1jvmhxccp2UvHNORpPePtJPv4:ZrOxDJs/Ksdl0R1dBmhFJERpPyJPvuXR
- TLSH
  T1F7936C203880C037F59748BBC9FAD6594A7E79544F6591DF7BC806A98F227D29F38207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  CKSINI.EXE
- Size 85KB
- SHA256 f37f6c1c401ebaf3f2879f62a524e1d5bb302e0ef5ae867ccfe7fafc7464f47d
- MD5 953896600dfb86750506706f1599d415
- SHA1 80204dd5ff71618de5e09d8090738672eaa966b0
- SHA512 06f702a2b09afa24356d2d1fa9331f6351e8ac58394d02edaa6a0673fb25dd02ab790bc8b2b157bdd10e631df59fbbfd5691543e522f92be9922fb95e3140085
- SSDEEP 1536:ZWd+OSckkrNv/FaXdIJQG8Jf6ClkCFyGjNZgXorEzMuHl/B3:YkNckAiJf6CimNZgXorEzMuHl/B3
- TLSH
  T182837D20B2D1C032E0A215344DB5E6B25E3EB8325E79C5C7B798077E5EA03C09B793A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  HTCTL32.DLL
- Size 316KB
- SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
- MD5 051cdb6ac8e168d178e35489b6da4c74
- SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
- SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
- SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
- TLSH
  T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  PCICHEK.DLL
- Size 14KB
- SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
- MD5 3aabcd7c81425b3b9327a2bf643251c6
- SHA1 ea841199baa7307280fc9e4688ac75e5624f2181
- SHA512 97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
- SSDEEP 192:uuYr6062b6Z1HVF6RRHXPPr+13fnYe+PjPIrI9FlP4r9ZCspE+TMlr78Vkf:uuYe72u6r+5nYPL7NheMr
- TLSH
  T1D562F7835BB41015EAE38FB15AF7C2565E36B7916FB4D1EF1190418A2E84FE02E2531B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  PCICL32.DLL
- Size 3.3MB
- SHA256 1a8ccf0b0e46e95a66c89a1ccffe573ec9e6ff781dc56e0790995429f4ff43d9
- MD5 c74d09967d40c3fe8d2b60cb70344054
- SHA1 fa6a9856089c07044226077150e377e14df58828
- SHA512 6ac1fdd1fbff45073f66953f4ad942e03bd81f73d08700c947167489f09a1b24144ba0057c1323ebdc07e389f36f1220790b0fb186f588d7fb7467f817234ec9
- SSDEEP 49152:lwWtZSlgPoqxyszApD0Ew0J94KinCgqmBQTdTBOHa3clSTmWZiwD:lwWrSlgHyszApD090mCgqzcS5E
- TLSH
  T17BF51832E5048872E1564079DC7D6AEC451A6DA00F1881EF798EF9AD2EF23D533B4F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Service.exe
- Size 33KB
- SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
- MD5 5a24676210bd317520fe30d048c9a106
- SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
- SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
- SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
- TLSH
  T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral11 behavioral12
- Target
  TCCTL32.DLL
- Size 378KB
- SHA256 6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299
- MD5 1e6e804ca71eaf5bef0abef95c578cf0
- SHA1 8eb7e6eff15edcb01d20322c4994512fdd1dd227
- SHA512 197b782efa21ac87a54d3e63f90a75d80d70a30bfd686d29ed36ede79328db2aef58c8b242906bf7a6c9c0b33b8fa5f0ef23e541bb0d5c0786481bdcce191061
- SSDEEP 6144:bn452GF6HWSJkgGjMTUjemzWz+ZsYRtFM2V3KZ/aDVpIxNc+KT5Ev7pt0AUazmgt:D452GF6HlkgGjMT8emzWusytFMKDXIxj
- TLSH
  T14284AF20BA41C131F5DA1174C6BCEFB56D7EB471172891CBABD608FA5F146D2AA3830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  pcicapi.dll
- Size 106KB
- SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
- MD5 67c53a770390e8c038060a1921c20da9
- SHA1 49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
- SHA512 201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
- SSDEEP 1536:LnzOfAUs8aONOb2H4NECHnTXg05rQMb2bbaPrw6BkJElFBIboKKGQ1w:LnSfAB8cb2YN7pSy8AuElFBIboKKGSw
- TLSH
  T1EFB38D01B192C5B2F5CA497806CB6B774F3D76A17E2450D3AB60D9810E7A7B37B1E20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  remcmdstub.exe
- Size 58KB
- SHA256 b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2
- MD5 5be6fb8f28544d4f83c25a2b76ff7890
- SHA1 6ad5d9338984c52b37f2176c8ae4ae2366a7fd25
- SHA512 7635fc41dd7be6a55d944db7790e31fd607bfdc67845185facd52bcda24da139c5ba4fe0292ead097eaa606ed53fcfd2ce96c2fb7a15f3aba5fe7262e8041028
- SSDEEP 1536:Uf6nvXuNcAjJMBUHYBlXU1wT2JFqywsQ:e6nPcjJ4U4I1jFqywL
- TLSH
  T112435B167655D033E842093019B8D2B28E7B793356B5C49F7FA807BA4FF17D06A2837A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

discoverynetsupportrat

behavioral12

discoverynetsupportrat

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

© 2018-2026

Terms | Privacy