NetSupport RAT Deployment via client32.exe After Phishing Loader

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects indicators associated with the deployment and execution of NetSupport RAT, including the launch of 'client32.exe', loading of the 'pcicl32.dll' module, outbound network connections, and the creation of the 'client.ini' configuration file. It also flags execution chains where 'client32.exe' is spawned by common browser or living-off-the-land processes.