netsupport | 52b29b43b364314968aaca8ef61f87e05d68bca81e3dfd445093c18cd6ea5ceb | Triage™

Login
Reports

Overview

overview

Static

static

5

AudioCapture.dll

windows10-2004-x64

3

AudioCapture.dll

windows11-ltsc_2024-x64

3

HTCTL32.dll

windows10-2004-x64

3

HTCTL32.dll

windows11-ltsc_2024-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICHEK.dll

windows11-ltsc_2024-x64

3

PCICL32.dll

windows10-2004-x64

3

PCICL32.dll

windows11-ltsc_2024-x64

3

Patch.html

windows10-2004-x64

3

Patch.html

windows11-ltsc_2024-x64

3

TCCTL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows11-ltsc_2024-x64

3

complex.exe

windows10-2004-x64

complex.exe

windows11-ltsc_2024-x64

msvcr100.dll

windows10-2004-x64

3

msvcr100.dll

windows11-ltsc_2024-x64

3

pcicapi.dll

windows10-2004-x64

3

pcicapi.dll

windows11-ltsc_2024-x64

3

remcmdstub.exe

windows10-2004-x64

3

remcmdstub.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
cognition.pbi.zip
Size 3.6MB
Sample261007-e57lgsssfs
SHA256 52b29b43b364314968aaca8ef61f87e05d68bca81e3dfd445093c18cd6ea5ceb
MD5 7e9611ba6f7e50de7e59121407a49994
SHA1 fbea420d9eef9ccd52935dc5c213831617ec7d72
SHA512 802062143c69af19424a43330091b8959cbc52713a9b47e9a0e247a32ec11fad859a82908c5173dcbd594b29c7c6fce79753e0b4ce55abbc39d5499252deac9a
SSDEEP 98304:R5dCLqFELrn327uFG1V3p2uZ4s8SIb8Z/dDCptE7N0ySb2:R5UL3Lb0xz3BBHq8ZtC4Si
TLSH
T1CC06334B8564925AD3B4313F7136CD86C5C2978F6E66ED4B209FD0C31B4E2AF82DA1B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

netsupport discovery rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

AudioCapture.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

AudioCapture.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

HTCTL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

HTCTL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

PCICHEK.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

PCICHEK.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

PCICL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

PCICL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

Patch.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral10

Sample

Patch.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral11

Sample

TCCTL32.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

TCCTL32.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

complex.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral14

Sample

complex.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

discovery netsupport rat

Behavioral task

behavioral15

Sample

msvcr100.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

msvcr100.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

pcicapi.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

pcicapi.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

remcmdstub.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

remcmdstub.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  AudioCapture.dll
- Size 87KB
- SHA256 2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
- MD5 7629af8099b76f85d37b3802041503ee
- SHA1 f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0
- SHA512 c209714ffdb0b95595583976340f2eb901eb9895f2f420afc4ca3c12744432e52fbedfd857b56cb347d4475df7678bd42d43f221208a108384e1df5aaf7d19e4
- SSDEEP 768:ZrOxYZwDgyfoVD/Ksdl0R8rKZEmU2ffE7CdmW1B1jvmhxccp2UvHNORpPePtJPv4:ZrOxDJs/Ksdl0R1dBmhFJERpPyJPvuXR
- TLSH
  T1F7936C203880C037F59748BBC9FAD6594A7E79544F6591DF7BC806A98F227D29F38207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  HTCTL32.DLL
- Size 320KB
- SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
- MD5 2d3b207c8a48148296156e5725426c7f
- SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
- SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
- SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
- TLSH
  T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  PCICHEK.DLL
- Size 18KB
- SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
- MD5 a0b9388c5f18e27266a31f8c5765b263
- SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
- SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
- SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
- TLSH
  T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  PCICL32.DLL
- Size 3.5MB
- SHA256 bd53de502b1e42fb825e3098d90b94eac74dd4b310acf815890952a6912acdde
- MD5 f1f5be34b3fed664a40941bc70c0574e
- SHA1 e0bdf139dc3a5dd3513cb53451f65bfb70f09b53
- SHA512 7afd4e4ed162f3fba02506ca06b018a48fe998a8e3b0c20cb5d4cf2c44abf93de6ac9d8dc9f30d8531453c521e10a22aca39a929673ede2bc016bda7f78da25a
- SSDEEP 49152:NOHDe5Yr6tYA4S+DjdwfwBTNZaZbkc9SENTIg:NOHDe5YrvS+tBUtSap
- TLSH
  T10AF50770EA448C75E1930476ED6DAADC412A6E750F2906CF3A8CB5091AF63D131F8F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Patch.css
- Size 829KB
- SHA256 98077384bfa1d810fb4309b76b55c57960366a3020b2804c6ee7fa515a50e8e3
- MD5 7e1079eaf8694198c86c55fe3568f038
- SHA1 e4bc06ebab424a86f6a848d70c636e746c2125cd
- SHA512 b45b702bc7e2f11867e0f9366e7ef458965a11c869972b37221c198899de1ecaa58c31330df49b944cb8f11fc259bd86e216c18a065e5af98d0d780b4adb1da3
- SSDEEP 12288:yZKlZKlZKlZKlZKlZKlZKlZKlZKlZKlZKlZKQZKlZK8:yZaZaZaZaZaZaZaZaZaZaZaZnZaZb
- TLSH
  T15705F12A273C7B635AC78F580DB3EA4AE891D544C76CD856F1FC2692CAE3E345981C34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  TCCTL32.DLL
- Size 382KB
- SHA256 092c3ec01883d3b4b131985b3971f7e2e523252b75f9c2470e0821505c4a3a83
- MD5 405a7bca024d33d7d6464129c1b58451
- SHA1 22b64e211d96d773c510ac82e7a73f8debf4e4cd
- SHA512 3c8d4cbf377a8beb793c93b63d521ccd75167dec02da43bb91434cb6b0737ca2d61fa201f2825fd1a0ceaae768bb53d78f737e7c412aae83d3cdc748893f31e6
- SSDEEP 6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp
- TLSH
  T197849F20BA80C139F1D61075C6BCDFBA7DADB870176851CB6BD509BA4F582D2E63834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  complex.exe
- Size 117KB
- SHA256 8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180
- MD5 5f35710f5128ddf6eb2c89e724b83d11
- SHA1 94e8d9a259ddff360e0ea5b03580f672c66712c4
- SHA512 768e384346b83372e4e04dd6030c3404258d40ee63ea50dacdfea7e4746d65a3316fc572febe1995619c128e3bd08441c4b58de8a25b388b6e003552d949af09
- SSDEEP 768:hEVZl6FhWr80/FK0r2bhuvtAKzCKZikGr2bhu2RPAKzCKZikZ:hG0hGNKU2huv+vv2huyYva
- TLSH
  T166C3C50F4699E173EA42E97DC8849B010C64BEC9B5F458FB105EF63E3E3178E2B6415A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery netsupport rat
- Family: NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral13 behavioral14
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  pcicapi.dll
- Size 32KB
- SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
- MD5 dcde2248d19c778a41aa165866dd52d0
- SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
- SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
- SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
- TLSH
  T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  remcmdstub.exe
- Size 61KB
- SHA256 89027f1449be9ba1e56dd82d13a947cb3ca319adfe9782f4874fbdc26dc59d09
- MD5 35da3b727567fab0c7c8426f1261c7f5
- SHA1 b71557d67bcd427ef928efce7b6a6529226415e6
- SHA512 14edadceeceb95f5c21fd3a0a349dd2a312d1965268610d6a6067049f34e3577fc96f6ba37b1d6ab8ce21444208c462fa97fab24bbcd77059bc819e12c5efc5a
- SSDEEP 1536:bJfanvXuN86jJ9hUHYBlXUYwT24a+yVwQ:lanPGjJTU4IYia+yVX
- TLSH
  T10C536C267655D033E9420D3015B8C2B39E7B796356B9809F7BA803BA5FF13C06A78376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

discoverynetsupportrat

behavioral14

discoverynetsupportrat

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

© 2018-2026

Terms | Privacy