{
  "family": "netsphere",
  "sample_count": 0,
  "category": "trojan",
  "description": "NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote administration tool and backdoor trojan developed in C++ and Borland Delphi. Designed for covert network control, NetSphere operates over TCP port 30103 (and configurable ports 30100-30102), providing remote operators with interactive remote desktop capture, keystroke interception, file system browsing, process termination, and remote reboot and shutdown commands. NetSphere was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized freeware utility bundles.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/NetSphere",
    "Trojan.Win32.NetSphere",
    "Backdoor.NetSphere",
    "Win32/NetSphere.RAT",
    "NetSphere.Server"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the NetSphere backdoor malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetSphere is a classic remote administration trojan developed in the early 2000s that operates over TCP port 30103."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can NetSphere execute?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Actions include screen capture, keystroke logging, file upload/download, remote shell access, and system shutdown."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors distribute NetSphere?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized game utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to NetSphere campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering NetSphere droppers have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against NetSphere?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block ports 30100-30103, deploy endpoint antimalware protection, and monitor registry Run keys and active sockets."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105",
    "T1562.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Block inbound network traffic to ports 30100-30103 on host firewalls and network perimeters.",
    "Identify and kill rogue executable processes listening on high ephemeral TCP sockets.",
    "Purge startup registry hooks in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform anti-malware disk scans to identify and quarantine related dropper binaries."
  ],
  "what_to_avoid": [
    "Do not allow unmonitored high-port listening sockets on legacy Windows workstations.",
    "Avoid continuing operation of a compromised machine without validating system integrity."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.NetSphere",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.NetSphere/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.NetSphere",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/netsphere"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2002,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Early Remote Administration Frameworks"
    ],
    "variants": [
      "NetSphere 1.0",
      "NetSphere 1.2",
      "Win32/NetSphere.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c",
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NetSphereServer",
      "Registry RunServices key under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}