{
  "Name": "NetSupport Manager",
  "Category": "RMM",
  "Description": "NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2026-06-15",
  "Details": {
    "Website": "https://www.netsupportmanager.com/",
    "PEMetadata": [
      {
        "Filename": "remcmdstub.exe",
        "OriginalFileName": "remcmdstub.exe",
        "Description": "NetSupport Remote Command Prompt Stub"
      }
    ],
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [
      "Remote command prompt"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "pcictlui.exe",
      "pcicfgui.exe",
      "client32.exe",
      "remcmdstub.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "geo.netsupportsoftware.com",
          "*.netsupportmanager.com",
          "netsupportmanager.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netsupport_manager_network_sigma.yml",
      "Description": "Detects potential network activity of NetSupport Manager RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netsupport_manager_processes_sigma.yml",
      "Description": "Detects potential processes activity of NetSupport Manager RMM tool"
    }
  ],
  "References": [
    "https://www.netsupportmanager.com/resources/",
    "https://www.netsupportmanager.com/complete-remote-control/",
    "https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/",
    "https://redcanary.com/threat-detection-report/threats/netsupport-manager/",
    "https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix",
    "https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "client32.exe",
      "pcicfgui.exe",
      "pcictlui",
      "pcictlui.exe",
      "remcmdstub.exe"
    ],
    "company_names": [],
    "signer_names": [
      "NetSupport Ltd",
      "Simon Tatham"
    ],
    "certificates": [
      {
        "signer_name": "Simon Tatham",
        "issuer": "CN=Sectigo Public Code Signing CA R36",
        "certificate_thumbprint": "6026ABF61401A3A86F1A4C6D37E7A4CC4D50B3AD",
        "tbs_sha256": "3D9382C098531F21907C342B98A10541EFB28405518CF834F21C3BA4649A39FE",
        "tbs_sha1": "ECB918730717D407950B66E230C12ED401C84D9D",
        "valid_from": "2021-11-06T00:00:00+00:00",
        "valid_to": "2024-11-05T23:59:59+00:00",
        "certificate_der_base64": "MIIGUTCCBLmgAwIBAgIRAI4/v7kb5toEG6Qfepg61h4wDQYJKoZIhvcNAQEMBQAwVDELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNjAeFw0yMTExMDYwMDAwMDBaFw0yNDExMDUyMzU5NTlaMFQxCzAJBgNVBAYTAkdCMRcwFQYDVQQIDA5DYW1icmlkZ2VzaGlyZTEVMBMGA1UECgwMU2ltb24gVGF0aGFtMRUwEwYDVQQDDAxTaW1vbiBUYXRoYW0wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCouP6/1Zf7dVxT8N05jnjSZiJ3h5XMdIL1i3RNXTldkEdxjet8x1mFtmYu1ldfAptvs1RZYTsbM4Mv7MJ1dYf9Dhz1AAO7AQIF4dEjFQo7bCrmp8gCt8to/nkwN1FRuh4Q4DmCi/e4DSqy/PUtQwH1iRI6FC2RPGblqdy8pNaK/v99AWh6m/ZgsJAcPcVDwgLRuIY731E+VgGiydQ/sE6DZvYPpGBHQ/L3klLYIFJ2MAA1Z1yQxlfW+IVMtBuZ5UOPIu89l6HvDhYRveJ2+I2KKJVz0krrpUkkIl34a0/3Qh6oQl6My6ggPbCM3E9yQ9PeIlqnSbvsLnJ8Cya+0aiZVOiakx531TAIwgbp0PlJy44q1zsZy4cRJ/kH0zm5Y8FWeeK+KBtSScGIASjkopGyKQ05TVeIe2mfsxhphPbXoUZaeYLASK5tvld+jHiAa1o8K1zVGP/4u0CiXicwpWRdtbw1qEr5Z+6tbCpg5BSBSBtBdHVO5gPmLds2EtqaWdTrX3MYMHXW/6SXj5AA/riFcdEgBsoWLgtgWb0xsURM5kRBnr76eWpr9D3Y0nK/5GwZAK+BDug7hryFTYrr97muYCLuIIip1nKHbI7LwKWMUFNQjXlImv2hTPeUnvXFCdddw3QWxD3cnDsx3ayzFA+ypDPK0oZ3MWjV4Zvy6CSkEwIDAQABo4IBnDCCAZgwHwYDVR0jBBgwFoAUDyrLIIcouOxvSK4rVKYpqhekzQwwHQYDVR0OBBYEFP+BvU11FnUCsL5jdXCrMXfb0uA/MA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMBEGCWCGSAGG+EIBAQQEAwIEEDBKBgNVHSAEQzBBMDUGDCsGAQQBsjEBAgEDAjAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBBAEwSQYDVR0fBEIwQDA+oDygOoY4aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcmwweQYIKwYBBQUHAQEEbTBrMEQGCCsGAQUFBzAChjhodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBUjM2LmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEMBQADggGBABy6w3V00NBOw9+xyDpXLaetITlU3FZwSYjtXswIGWUIsGspNiL0PkLlsWwjF9xTu8k/HXY/q8mMveONY1QJ01/BNQtwJUbXTQZytZw9y2DFX+g0JX+GhqAxrhOTaLAayuklG4yB9FPUAURDwMflrrOruhVw+vVvLhy7jpHOJZgWbGwZKVSwJmXMxKQD8DQIiECWoreDAcAtOxGOGgMBeDI3RZAzNKwkE4MEWNRiWfUZVPARD5E58Kc7R+ahD/F6LRm/2+hHtf8uJqwfZ3nmP69SHp7juZovfguYMUoKSbstYUJSPbzC6844vefQh3pWh7kk13bcZ29VxozwBORdZuEDIaDPZcOchG9D9DVuDRJVnrYaucotTWwmrPY4SC8c96j4QNUpZqjpDuryucunDc76mqCkcPgOVjIG8sFZotntgfQjRoTr5tCvTGD167nM1FUKi4nTrr0W4LrShiILM01ZEGwz7nll3cE+Ey0D0ZbgBCIAIw/ugG9F4V8RSG7I+g=="
      },
      {
        "signer_name": "NetSupport Ltd",
        "issuer": "CN=VeriSign Class 3 Code Signing 2009-2 CA",
        "certificate_thumbprint": "435A8DAF631D61F4277FD77172B8F11132586EA0",
        "tbs_sha256": "981F4E400F3855D33FC61580297B279A85424BDB015FD0CE22234113EB684C07",
        "tbs_sha1": "0BFDCC6AD2055D1E1C66C2554AF56ED334AFA565",
        "valid_from": "2009-07-08T00:00:00+00:00",
        "valid_to": "2011-08-21T23:59:59+00:00",
        "certificate_der_base64": "MIIFBzCCA++gAwIBAgIQLm+f/7sq9bnLBVmEfV5ZdDANBgkqhkiG9w0BAQUFADCBtjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEwMC4GA1UEAxMnVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwOS0yIENBMB4XDTA5MDcwODAwMDAwMFoXDTExMDgyMTIzNTk1OVowgcQxCzAJBgNVBAYTAkdCMRcwFQYDVQQIEw5DYW1icmlkZ2VzaGlyZTEVMBMGA1UEBxMMUGV0ZXJib3JvdWdoMRcwFQYDVQQKFA5OZXRTdXBwb3J0IEx0ZDE+MDwGA1UECxM1RGlnaXRhbCBJRCBDbGFzcyAzIC0gTWljcm9zb2Z0IFNvZnR3YXJlIFZhbGlkYXRpb24gdjIxEzARBgNVBAsUCk5ldFN1cHBvcnQxFzAVBgNVBAMUDk5ldFN1cHBvcnQgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCDtzYbG/oY6Dyuu/elthBHo7L8IVAYzctOlk89V1ptL1Wx7KeygDDwdnAG8wwNvH0/DwElGdbqguYWZiO53yAsB+O7NevwJb9+BUoo1ZxR0Rrz6mtSas36e/Sy+X3PIk0JTMXnw3DG8+uhYfkiKnr7lFPpQR39+QuZErUjxjYrFQIDAQABo4IBgzCCAX8wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwRAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2NzYzMtMjAwOS0yLWNybC52ZXJpc2lnbi5jb20vQ1NDMy0yMDA5LTIuY3JsMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHFwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTATBgNVHSUEDDAKBggrBgEFBQcDAzB1BggrBgEFBQcBAQRpMGcwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA/BggrBgEFBQcwAoYzaHR0cDovL2NzYzMtMjAwOS0yLWFpYS52ZXJpc2lnbi5jb20vQ1NDMy0yMDA5LTIuY2VyMB8GA1UdIwQYMBaAFJfQa6gmcMihP5QfCC3ENZukoR7yMBEGCWCGSAGG+EIBAQQEAwIEEDAWBgorBgEEAYI3AgEbBAgwBgEBAAEB/zANBgkqhkiG9w0BAQUFAAOCAQEAAM+QCZqxXvCfBpat9dJJqA4BUB/pAMBnspVKaBlR1Zi2j+Zi5RVz73PikKlakQOeFnjY74EB/gTiYYlLPl1RkBVAUPV9FaB69wrxJv/O3f9lZaLFcsi3M4DBfhdzsV0M7pmZDHQSxDCwAvPIwHzKc/temcJptT43wR7bfsiT3AsU8DOoZ+9f4s/mP5A9eVQtHM/2MKy3aI6jZuwjIhx1tstOvRp0GyDlWrKRM5N9aFuscagWKL2VOEfvnBLQApbfNBM2SCVixLJAp7WbfaDmZVaPoFsT8rqvgQUQg/Y9G8hcBApH4u7ffFY8du7uGWoqM7eHHn30nX98hp3eAiAAsg=="
      },
      {
        "signer_name": "NETSUPPORT LTD.",
        "certificate_thumbprint": "061DFEC06DE16DF52E9BD821E4248E81E82246E0",
        "certificate_der_base64": "MIIH3jCCBcagAwIBAgIMIeMX/YiMlwTmHemwMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNTA1MjkxNTEzMTdaFw0yODA3MTcxMzAxMTVaMIIBHDEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xETAPBgNVBAUTCDAyMzg2NjM4MRMwEQYLKwYBBAGCNzwCAQMTAkdCMQswCQYDVQQGEwJHQjEXMBUGA1UECBMOQ2FtYnJpZGdlc2hpcmUxFTATBgNVBAcTDFBldGVyYm9yb3VnaDE4MDYGA1UECRMvTmV0c3VwcG9ydCBIb3VzZSBUb3duZ2F0ZSBFYXN0LCBNYXJrZXQgRGVlcGluZywxGDAWBgNVBAoTD05FVFNVUFBPUlQgTFRELjEYMBYGA1UEAxMPTkVUU1VQUE9SVCBMVEQuMSgwJgYJKoZIhvcNAQkBFhlpc0BuZXRzdXBwb3J0c29mdHdhcmUuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAw/PAOehy6dRc7Au6yX4xn3fcEhoIaqhI4HpmUG2bHW8RYtYhvN57qyOwx6gKm7lTjaJqDpoyBsY0inslnJIsyGNgiwpcfITYhfo4bXcdojWSWnfyNA9WlrSVTwARhstsggtJtBwAGqj2RDejXv/tTlqjtSK8u5YTx/GaGtXUWtGaASfEhCeBONKoWvLLtwF45NmyQSrCTdRVex5Se0X7vLtFb2g8fB/2id0gues2weZym/2OBdkpN3JaQpGQwjrP/P6hSemwafyG+o1/1QLdbvRHIDooAxZ6Sz2+wxYWjA5vLrwYtA5+K06XfJF8y4zzbHOOgaswvRqeoyMnWznJMCJ61bFkNaEMVwc1eTeTYu51DgQTDTeswtX+4agAWW3O792X5lgjod+IEECc9JAsJDV18hihN3coNkuXuhloPhKLypn8EW/BUPTlovxvlsvgzpV46gudxAQzr42QQbFHhOFnF+dzlUFxvHttbPn4SBahJEHxoEq+XtY68PgOqu598izTWAtdgfoeS/Z4yshIPQB5XJk0WycB6Krd4z5IJHN/TNYY1YKTrM6KpvEIbtOVYrKnHBXpc//IxX5qODaxVavXbOVokHZei0mRi9e/GIPJvJEVJP6Rh3+Ym/yjvUHy00WuDQ+QzwwKC4+KDEf1lPRDq/UnmctguCeMrmMp2pECAwEAAaOCAdwwggHYMA4GA1UdDwEB/wQEAwIHgDCBnwYIKwYBBQUHAQEEgZIwgY8wTAYIKwYBBQUHMAKGQGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcnQwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMDBVBgNVHSAETjBMMEEGCSsGAQQBoDIBAjA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAHBgVngQwBAzAJBgNVHRMEAjAAMEcGA1UdHwRAMD4wPKA6oDiGNmh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNDVldmNvZGVzaWduY2EyMDIwLmNybDAkBgNVHREEHTAbgRlpc0BuZXRzdXBwb3J0c29mdHdhcmUuY29tMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB8GA1UdIwQYMBaAFCWd0PxZCYZjxezzsRM7VxwDkjYRMB0GA1UdDgQWBBQFe+NgbkzLPQDTdRnj+Oi2AMoMCjANBgkqhkiG9w0BAQsFAAOCAgEAgmd8nDVvPcRHGs330DtzF3AxuNfbQ8kdgTvMoN1x6MWd4mtY56ed+fRSUAZNSIyk399Ee0K+a/q+SUsfJWodb4NMJ5B1+nywz4z8dJ5TRE9DBBRvtCjJ8pvKMQjfn9KfRpPV2I9RN/Lf29OU8ZboFnh/un+8xgfqPmLJFoajWBeZowhVzC7Qox6t9JoO6XcImtYEF2uCYBVOqHQ4Uk9aX3KrB977h34XmT9TehUPn33FFj5x5WbnbwGVDA8ripvLT9wY3oyfFqYJZ8JT4oB5f6nf4XpgFHdTUSsryplVWIKRQsjdvZDeTE2RdxZaR86WbO9eiyTH46od77v05Y4QA9uyQyKFUteQOvGMF86sP0v7ZnbqFb0bk7TJahXHYoh0Nza1oJsqGhc1Cd02wYOqUl0trA2lOCmkDHhxVru5rY37UYE93kyTazxK661iFt6NDqmEswdQZ3+pd5t4l6nxRt6LTU6gJqlYqwPRuwCXmqYr2H8ikDav86JTK5ULoi8Fb2GXOwqNNDvqdRk0zoJLi9yxkJHbr/DXzqKYqHTM9yjIN1LSF+0onCbYs4cTu7rDOOahtnioz1O5vt6FZtCA7Fb6vMKWYA+R5xvQ8vwAaECiTRvHRujVuIziVBirOrm9Ztq9DZdrfiVGK13l4JF1Z7vHXBu8ih+HJ4II/BGC0q0=",
        "src_file_sha256": "a0ce8c26b6b322cc7311b19decab019dcdd2766768e011936d7701ac75a97ee9",
        "src_file_path": "downloaded_files/netsupport_manager/a0ce8c26b6b322cc7311b19decab019dcdd2766768e011936d7701ac75a97ee9",
        "src_file_company": "NetSupport Ltd"
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "pcictlui.exe",
        "sha256": "E176AFE937B564EFB92EA2BF9D8637F16C5CEB0DCC25C78006A494B630520357",
        "sha1": "BC5EE8C8516010512D3FE2A43154053B0849D786"
      },
      {
        "file_name": "pcictlui",
        "sha256": "F4F5A883014EB39AEA7DA4448FFE160245AEB89808080D26D63628998B08E6A5",
        "sha1": "5718989BCB7D5BD84E2F54C2258F6A11FAE5607E"
      }
    ],
    "page": [
      {
        "file_name": "pcictlui.exe",
        "sha256": "13A2EB0CB8DA8A3E92D05B08FCEB3A1273BBC0A3FD1743187EEBD6E49BFD59C2",
        "sha1": "1D15BCE915E4CB9AA1CC9CC467AD50D36EB19590"
      },
      {
        "file_name": "pcictlui",
        "sha256": "E6BD8D309C4F3FE08DF483C0F2FE7A89617922F08547F94ECA802DC2D449F1CC",
        "sha1": "B498816D255C122EA1890EBC81E92ED820EC792D"
      }
    ]
  }
}