RMM
NetSupport Manager
NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2026-06-15
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Capabilities
Executables & installation paths
- Filename
- remcmdstub.exe
- OriginalFileName
- remcmdstub.exe
- Description
- NetSupport Remote Command Prompt Stub
Installation paths
pcictlui.exe
pcicfgui.exe
client32.exe
remcmdstub.exe
Code signing
- signer name
- Simon Tatham
- issuer
- CN=Sectigo Public Code Signing CA R36
- certificate thumbprint
- 6026ABF61401A3A86F1A4C6D37E7A4CC4D50B3AD
- tbs sha256
- 3D9382C098531F21907C342B98A10541EFB28405518CF834F21C3BA4649A39FE
- tbs sha1
- ECB918730717D407950B66E230C12ED401C84D9D
- valid from
- 2021-11-06T00:00:00+00:00
- valid to
- 2024-11-05T23:59:59+00:00
- signer name
- NetSupport Ltd
- issuer
- CN=VeriSign Class 3 Code Signing 2009-2 CA
- certificate thumbprint
- 435A8DAF631D61F4277FD77172B8F11132586EA0
- tbs sha256
- 981F4E400F3855D33FC61580297B279A85424BDB015FD0CE22234113EB684C07
- tbs sha1
- 0BFDCC6AD2055D1E1C66C2554AF56ED334AFA565
- valid from
- 2009-07-08T00:00:00+00:00
- valid to
- 2011-08-21T23:59:59+00:00
- signer name
- NETSUPPORT LTD.
- certificate thumbprint
- 061DFEC06DE16DF52E9BD821E4248E81E82246E0
- src file sha256
- a0ce8c26b6b322cc7311b19decab019dcdd2766768e011936d7701ac75a97ee9
- src file path
- downloaded_files/netsupport_manager/a0ce8c26b6b322cc7311b19decab019dcdd2766768e011936d7701ac75a97ee9
- src file company
- NetSupport Ltd
search names
client32.exe
pcicfgui.exe
pcictlui
pcictlui.exe
remcmdstub.exe
company names
signer names
NetSupport Ltd
Simon Tatham
File hashes
- authenticode
- file name
- pcictlui.exe
- sha256
- E176AFE937B564EFB92EA2BF9D8637F16C5CEB0DCC25C78006A494B630520357
- sha1
- BC5EE8C8516010512D3FE2A43154053B0849D786
- file name
- pcictlui
- sha256
- F4F5A883014EB39AEA7DA4448FFE160245AEB89808080D26D63628998B08E6A5
- sha1
- 5718989BCB7D5BD84E2F54C2258F6A11FAE5607E
- page
- file name
- pcictlui.exe
- sha256
- 13A2EB0CB8DA8A3E92D05B08FCEB3A1273BBC0A3FD1743187EEBD6E49BFD59C2
- sha1
- 1D15BCE915E4CB9AA1CC9CC467AD50D36EB19590
- file name
- pcictlui
- sha256
- E6BD8D309C4F3FE08DF483C0F2FE7A89617922F08547F94ECA802DC2D449F1CC
- sha1
- B498816D255C122EA1890EBC81E92ED820EC792D
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- geo.netsupportsoftware.com
- *.netsupportmanager.com
- netsupportmanager.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netsupport_manager_network_sigma.yml
- Description
- Detects potential network activity of NetSupport Manager RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netsupport_manager_processes_sigma.yml
- Description
- Detects potential processes activity of NetSupport Manager RMM tool
References
- https://www.netsupportmanager.com/resources/
- https://www.netsupportmanager.com/complete-remote-control/
- https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/
- https://redcanary.com/threat-detection-report/threats/netsupport-manager/
- https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/