| File name: | bad.zip |
| Full analysis: | https://app.any.run/tasks/45a77dc2-3efa-4518-8149-997fd2b51512 |
| Verdict: | Malicious activity |
| Threats: | NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software. |
| Analysis date: | June 03, 2025, 20:50:14 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | F0AB90E210074FF19D0C36D0814E73C3 |
| SHA1: | FEBC3E1F3DA5E4C0AE8948D17A5785F2F9CCBDDB |
| SHA256: | 73300A2C33D9DB92048B641E13158E77AAF7A48DE9CC51B66EF3200690CF5E21 |
| SSDEEP: | 98304:TqzXi5cxvTp89RydEd824WbdhpkxspEuAF8YZMitEGOSyRei7Rc1bNXqbUTT10+J:lFiT0o6olotoqodo+ |
MALICIOUS
NETSUPPORT has been found (auto)
- WinRAR.exe (PID: 5956)
NETSUPPORT mutex has been found
- client32.exe (PID: 6620)
- client32.exe (PID: 7908)
NETSUPPORT has been detected (YARA)
- client32.exe (PID: 6620)
Connects to the CnC server
- client32.exe (PID: 6620)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 6620)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 5956)
Process drops legitimate windows executable
- WinRAR.exe (PID: 5956)
Drop NetSupport executable file
- WinRAR.exe (PID: 5956)
There is functionality for communication over UDP network (YARA)
- client32.exe (PID: 6620)
Connects to the server without a host name
- client32.exe (PID: 6620)
There is functionality for taking screenshot (YARA)
- client32.exe (PID: 6620)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 5956)
The sample compiled with english language support
- WinRAR.exe (PID: 5956)
Reads the computer name
- client32.exe (PID: 6620)
- client32.exe (PID: 7908)
Checks supported languages
- client32.exe (PID: 6620)
- client32.exe (PID: 7908)
Manual execution by a user
- client32.exe (PID: 7908)
Reads the software policy settings
- slui.exe (PID: 5024)
Checks proxy server information
- slui.exe (PID: 5024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (33.3) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:05:02 19:56:18 |
| ZipCRC: | 0x49f7b0fe |
| ZipCompressedSize: | 168780 |
| ZipUncompressedSize: | 328056 |
| ZipFileName: | HTCTL32.DLL |
Total processes
134
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5024 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5956 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\bad.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6620 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\client32.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\client32.exe | WinRAR.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Version: V14.10 Modules
| |||||||||||||||
| 7864 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7908 | "C:\Users\admin\AppData\Local\Temp\bad\client32.exe" | C:\Users\admin\AppData\Local\Temp\bad\client32.exe | explorer.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: MEDIUM Description: NetSupport Client Application Exit code: 255 Version: V14.10 Modules
| |||||||||||||||
Total events
7 509
Read events
7 482
Write events
14
Delete events
13
Modification events
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\bad.zip | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (5956) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
66
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\NSM.ini | binary | |
MD5:88B1DAB8F4FD1AE879685995C90BD902 | SHA256:60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\NSM.LIC | text | |
MD5:390C964070626A64888D385C514F568E | SHA256:AD0D05305FDEB3736C1E8D49C3A6746073D27B4703EB6DE6589BDC4AA72D7B54 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\TCCTL32.DLL | executable | |
MD5:EAB603D12705752E3D268D86DFF74ED4 | SHA256:6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\remcmdstub.exe | executable | |
MD5:1768C9971CEA4CC10C7DD45A5F8F022A | SHA256:6558B3307215C4B73FC96DC552213427FB9B28C0CB282FE6C38324F1E68E87D6 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\PCICHEK.DLL | executable | |
MD5:A0B9388C5F18E27266A31F8C5765B263 | SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\hw.dll | executable | |
MD5:A74C64DE593E2533C04200C5417BD9E9 | SHA256:BE45F76049A133392423679D334C69C8E1E7E82DC873EEBDD229EA0341BA1B10 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\msvcr100.dll | executable | |
MD5:0E37FBFA79D349D672456923EC5FBBE3 | SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\PCICL32.DLL | executable | |
MD5:00587238D16012152C2E951A087F2CC9 | SHA256:63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\nskbfltr.inf | binary | |
MD5:26E28C01461F7E65C402BDF09923D435 | SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368 | |||
| 5956 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa5956.18426\rgatai\vpnclient2.dll | executable | |
MD5:DA8E45FA4B3B19AE94440302F8CB979F | SHA256:C58A3E9335571988327AE1DDF0C9AD5717C03AF41D555A636A43A004A18DFDC8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
33
DNS requests
16
Threats
33
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6620 | client32.exe | POST | — | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
6620 | client32.exe | POST | — | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
6620 | client32.exe | POST | 200 | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
6620 | client32.exe | POST | 200 | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
6620 | client32.exe | POST | — | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
6620 | client32.exe | POST | — | 94.158.245.140:443 | http://94.158.245.140/fakeurl.htm | unknown | — | — | malicious |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.34:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6368 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.63.118.230:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.34:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6544 | svchost.exe | 20.190.160.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 20.190.160.131:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
6544 | svchost.exe | 23.63.118.230:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6544 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7600 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
— | — | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
— | — | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
— | — | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |
— | — | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Checkin |
— | — | Misc activity | ET REMOTE_ACCESS NetSupport Remote Admin Response |
— | — | Potentially Bad Traffic | ET INFO HTTP traffic on port 443 (POST) |
— | — | A Network Trojan was detected | REMOTE [ANY.RUN] NetSupport RAT |