MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetSupport


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562
SHA3-384 hash: 030c0b1934f3808327ec1dc11e6cf54e8a5284ef694b9782f186e39500d9b3df59d64b527648fc75e2c2b7cd216ae8dd
SHA1 hash: f951ac3f40b2e5ccb7e63e428df0ea3c686fc44c
MD5 hash: b78c3ee6f8be2e61ab989a9d0f834a80
humanhash: west-summer-delta-blue
File name:c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562.cab
Download: download sample
Signature NetSupport
Create hunting rule
File size:3'549'579 bytes
First seen:2026-07-13 07:09:32 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 98304:paFBWxVeoWcczqbOy9kSvgmE32urgq0tg:pWBWjeCaTy9lvQ329q0tg
TLSH T133F5335E7AC39EDA8C9F3BB4D24D3285803AF9469473775821FBC5164F963C972B2280
Magika cab
Reporter JAMESWT_WT
Tags:cab client32 golzap-com ini LIC NetSupport

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
IT IT
File Archive Information

This file archive contains 15 file(s), sorted by their relevance:

File name:nskbfltr.inf
File size:328 bytes
SHA256 hash: d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
MD5 hash: 26e28c01461f7e65c402bdf09923d435
MIME type:application/x-setupscript
Signature NetSupport
File name:string.txt
File size:82 bytes
SHA256 hash: 8cc8ca35f93692750ca1b1baad211d52aebf68f67d54bf304097432d261324bd
MD5 hash: 8d39dd1c0fd3ae3a111b3f6c71df1014
MIME type:application/octet-stream
Signature NetSupport
File name:TCCTL32.DLL
File size:470'976 bytes
SHA256 hash: 4e36d177064c6187db053fc42f32100a99de934c8d2a7fa36c41ec048fe4b147
MD5 hash: bb144d1221e6e2c4b4dbbd1465e4751e
MIME type:application/x-dosexec
Signature NetSupport
File name:NSM.ini
File size:6'458 bytes
SHA256 hash: 60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92
MD5 hash: 88b1dab8f4fd1ae879685995c90bd902
MIME type:application/x-wine-extension-ini
Signature NetSupport
File name:client32.ini
File size:792 bytes
SHA256 hash: ed32e8d0e675d715dfa3f62880365c280d4100dcc27534b498216d0169906414
MD5 hash: 1e43a951f4001d801400ca8c844a8661
MIME type:text/plain
Signature NetSupport
File name:Onedrive.dll
File size:3'501'384 bytes
SHA256 hash: adc7aeb96dd4c244afc5b354b0100d29d224e3b8a71e88afa281df4be56c36dd
MD5 hash: e2fa97f0a14465d05004433608ff7218
MIME type:application/x-dosexec
Signature NetSupport
File name:PCICHEK.DLL
File size:32'192 bytes
SHA256 hash: e59f40c223e6e125f5194b87b08b6c8471164abce52aa525380e7d60bd597394
MD5 hash: 095ede24cd9471d8c397223ce03b43e6
MIME type:application/x-dosexec
Signature NetSupport
File name:msvcr100.dll
File size:773'968 bytes
SHA256 hash: 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 hash: 0e37fbfa79d349d672456923ec5fbbe3
MIME type:application/x-dosexec
Signature NetSupport
File name:pcicapi.dll
File size:49'600 bytes
SHA256 hash: 70d5ea29311195d3cab296f57d69a89bbec289e29d3517543f58389f3cda57f8
MD5 hash: 2d8f11832724b6bab0023f1cf34a5452
MIME type:application/x-dosexec
Signature NetSupport
File name:office.exe
File size:18'432 bytes
SHA256 hash: 34da81c59b74035c22f7f9f8c9c3ee4fdb3b3f501524f3b49fd95f7c83bbd0f9
MD5 hash: ad9c2df5d87e1970b8c69bcfb2c5b1d6
MIME type:application/x-dosexec
Signature NetSupport
File name:NSM.LIC
File size:259 bytes
SHA256 hash: b7818edeb28f19baba42c8aef7a2a232dc008fd361d1184a982801255392c85e
MD5 hash: b847ae2e918008e7b5e10e52fcc83e18
MIME type:text/plain
Signature NetSupport
File name:nsm_vpro.ini
File size:46 bytes
SHA256 hash: 4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
MD5 hash: 3be27483fdcdbf9ebae93234785235e3
MIME type:text/plain
Signature NetSupport
File name:2
File size:346 bytes
SHA256 hash: 49a60be4b95b6d30da355a0c124af82b35000bce8f24f957d1c09ead47544a1e
MD5 hash: 24d3b502e1846356b0263f945ddd5529
MIME type:text/plain
Signature NetSupport
File name:htctl32.dll
File size:323'912 bytes
SHA256 hash: 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
MD5 hash: 051cdb6ac8e168d178e35489b6da4c74
MIME type:application/x-dosexec
Signature NetSupport
File name:remcmdstub.exe
File size:77'248 bytes
SHA256 hash: ccc2d753ce0677b409a15005d40620b4249b4766c0870340039c48d76f68c055
MD5 hash: 9eb592cd74782f82216f0cdfca864a9e
MIME type:application/x-dosexec
Signature NetSupport
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/474c882a-fdcd-420e-ae4f-098c76c8ac55/
Detection(s):
SecuriteInfo.com.Program.RemoteAdmin.840.6705.12909.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Program.RemoteAdmin.931.9401.9800.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphiKo-1
Create hunting rule

PUA.Win.Tool.NetSupport-10022498-8
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a548f8c3d3a766c4391accb
Tags:
injection dropper netsup virus
Verdict:
Unknown
Threat level:
n/a  -.1.0/10
Confidence:
100%
Tags:
anti-debug crypto evasive expired-cert exploit fingerprint microsoft_visual_cc reconnaissance signed
Link:
https://www.filescan.io/uploads/6a548f7f08007e979d702ea9/reports/2b0517da-ecdd-4aec-bbc6-6c0c7215321b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562
Verdict:
Malicious
File Type:
cab
First seen:
2026-06-09T05:51:00Z UTC
Last seen:
2026-06-09T06:33:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562/results?tab=lookup
Score:
86%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
CAB:COMPRESSION:MSZIP Executable PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/b78c3ee6f8be2e61ab989a9d0f834a80
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562/
Threat name:
Win32.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 02:58:50 UTC
File Type:
Binary (Archive)
Extracted files:
866
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yctz65o2bbj75prxpxwu4672aarfo7pjv5tq4fkzyae7gfw22vra._file
Result
Malware family:
netsupport
Create hunting rule
Score:
  10/10
Tags:
family:netsupport discovery rat
Link:
https://tria.ge/reports/260713-jslwgady2r/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0a79f75da0853febe377ded4e7bfa0022577de9af670e1559c009f316dad562

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments