MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c
SHA3-384 hash:	c2492f22dae9efd2a4602f406f6e8d882f86591704ac8d9cc87f424a15d3271d06a5652a8d4e2ea3f8b45ae9ded21ea6
SHA1 hash:	1e9bf68e5879a42119c41e99593c800e4efb9fa8
MD5 hash:	21b42720a156c1ce18019010ecec2a39
humanhash:	seventeen-tennessee-north-harry
File name:	bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c.exe
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	120'288 bytes
First seen:	2026-11-05 00:29:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	a9d50692e95b79723f3e76fcf70d023e (13 x NetSupport)
ssdeep	768:LfVZl6FhWr80/SqUr2pe/3NEHDHf/ck+fGr2pe/keHDHf/ck7:L70hGaq0ee/3ujHjee/tjH/
TLSH	T1BAC3B34F429DE173EA42E97CC4819B050DA4BEC9B9B458FB005EF63E3E3178E2B5415A
TrID	21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 21.2% (.EXE) Win64 Executable (generic) (6522/11/2) 16.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 14.6% (.EXE) Win32 Executable (generic) (4504/4/1) 6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	4d2d52417121a151 (14 x NetSupport)
Reporter	Tuxxin
Tags:	exe NetSupport signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

177

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN netsupport

Malware family:

netsupport

Alert

Create hunting rule

ID:

1

File name:

29a247f5d040a8f71716c181c70bfa46.exe

Verdict:

Malicious activity

Analysis date:

2026-04-06 09:56:06 UTC

Tags:

anti-evasion auto-startup netsupport rmm-tool tool

Link:

https://app.any.run/tasks/502557a0-3414-4d75-a15a-8f2087a1802c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/97297/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.RA.587.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aebce1e7d28ff7e598cb3bf

Tags:

netsup lien

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

FileScan.io

Gathering data

Hybrid Analysis Win/grayware_confidence_90%

Verdict:

Malicious

Labled as:

Win/grayware_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

exe x32

First seen:

2024-12-20T09:57:00Z UTC

Last seen:

2026-11-04T06:06:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/5a27eb11-72c4-4775-b5d2-e442d7e725f8

Joe Sandbox NetSupport RAT

Result

Threat name:

NetSupport RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1998654

Signature

Detected potential unwanted application

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

65%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/21b42720a156c1ce18019010ecec2a39

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqbaxfp4ah5oidqt6qu6vxpky3aiovjztwlna3u5x2rccfhllfoa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/261105-atn8jsgz8p/

Behaviour

System Location Discovery: System Language Discovery

Threat.Zone Suspicious

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

ConventionEngine_Keyword_Client

Link:

https://app.threat.zone/submission/166b3678-44d0-44e7-b3ac-e45a5105d3e4

UnpacMe

Unpacked files

SH256 hash:

bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c

MD5 hash:

21b42720a156c1ce18019010ecec2a39

SHA1 hash:

1e9bf68e5879a42119c41e99593c800e4efb9fa8

Link:

https://www.unpac.me/results/90a0453b-3af7-42a9-a868-e446e437dd39/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetSupport

exe bc020b95fc01fae40e13f429eaddeac6c08755399d96d06e9dbea22114eb595c

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/97297/