Extracted

• • Target

    5a8f908de929fa670000c3c72a900288.js

  • Size

    66KB

  • MD5

    5a8f908de929fa670000c3c72a900288

  • SHA1

    b62fe78ce6c9cfe5040a8e94c522dcff7a43de4f

  • SHA256

    2ecee022c36e71313e1af91b039671ddabf56f2f28db3141e48d15dccf96064f

  • SHA512

    73cdc14322e7570fd835480e09211c3211eee9503368ec8a2567aec5b0c0f15c8628640f7cdab3de28a681cf2ef914b3c6874b48fa111ff6478d5bffa39c2543

  • SSDEEP

    1536:je6R4Qklp7XoRZ93vd3LjUlqFF0gx4iwgQBk6buzxF8z:jxPklp7cr3vJ/UlqFKgxtwgQBfbUS

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2