{
  "family": "nettool",
  "sample_count": 23,
  "category": "hacktool",
  "description": "NetTool (cataloged across security intelligence feeds under signatures including HackTool:Win32/NetTool, Tool:Win32/NetTool, and Trojan.NetTool) is an offensive network scanning, port probing, and lateral movement hacking utility active since 2010. Frequently weaponized by intrusion operators, penetration testers, and cybercriminal syndicates during post-exploitation phases, NetTool automates high-speed IP range discovery, TCP/UDP port mapping, and SMB/NetBIOS banner grabbing across internal enterprise subnets. Once an internal network foothold is established, threat actors deploy NetTool to identify vulnerable unpatched hosts, detect exposed administrative services (such as RDP, Telnet, and SSH), and assist in credential-spraying attacks to facilitate lateral movement across the enterprise perimeter.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/NetTool",
    "Tool:Win32/NetTool",
    "Trojan:Win32/NetTool",
    "Win32/NetTool",
    "NetTool Scanner"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/NetTool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetTool is an offensive network reconnaissance and scanning hacktool used by attackers to discover vulnerable internal hosts and open ports."
      }
    },
    {
      "@type": "Question",
      "name": "How is NetTool used in cyber attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers deploy NetTool after gaining initial access to map internal subnets, locate domain controllers, and identify open RDP/SMB ports."
      }
    },
    {
      "@type": "Question",
      "name": "Why is NetTool flagged as a HackTool by antivirus software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Antivirus engines flag it because its scanning and probing capabilities are routinely used by threat actors to prepare lateral movement."
      }
    },
    {
      "@type": "Question",
      "name": "What network protocols are probed by NetTool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans TCP/UDP ports, performs NetBIOS name queries, probes SMB services, and banner-grabs HTTP and SSH servers."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect NetTool scanning on internal networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy network intrusion detection (IDS) to alert on rapid SYN scans across internal subnets and audit process execution in EDR."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1046",
    "T1018",
    "T1059.003",
    "T1082",
    "T1021.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Post-Exploitation Manual Deployment",
    "Secondary Malware Payload Download",
    "Penetration Testing Toolkit Bundles"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "High-Speed Subnet IP & Port Scanning",
    "SMB / NetBIOS Service Enumeration",
    "Administrative Service Discovery (RDP, SSH, Telnet)",
    "Automated Banner Grabbing",
    "Command-Line Report Output"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Console Utility)",
      "Scanning Report File (.txt/.csv)"
    ],
    "network_signatures": [
      "Bursts of TCP SYN packets across internal enterprise subnets targeting ports 445, 3389, 22, and 80",
      "NetBIOS status request packets (UDP port 137) broadcast to discover hostnames"
    ],
    "evasion_techniques": [
      "Adjustable scanning thread count to avoid triggering simple network threshold alerts",
      "Standalone portable executable execution requiring no system installation"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0",
      "48f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "registry_keys": [],
    "file_paths": [
      "%Temp%\\nettool.exe",
      "%LocalAppdata%\\Temp\\scan_results.txt"
    ]
  },
  "defensive_measures": [
    "Deploy internal network intrusion detection (NIDS) to detect abnormal horizontal port scanning between workstations",
    "Restrict network communications between client endpoints using host-based firewalls (blocking workstation-to-workstation SMB/RDP)",
    "Enforce application control policies (WDAC/AppLocker) to prevent unauthorized hacking tools from running on endpoints"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/NetTool",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/NetTool"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Hacktool.Win32.NetTool",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "HackTool:Win32/NetTool.A",
      "Tool:Win32/NetTool.gen"
    ]
  },
  "motivation": "Internal Network Reconnaissance, Vulnerability Discovery & Lateral Movement",
  "sample_hashes": []
}