Overview

overview

10

Static

static

1

Notice_17_...899.js

windows7-x64

3

Notice_17_...899.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Notice_17_apr_2468899.js

  • Size

    519KB

  • Sample

    230418-vvjpnsef91

  • MD5

    cf6e5af0b38c8e28cb0cb0760845b6fd

  • SHA1

    8ed18fc48813e4df42704e7a71385930ec21ac2b

  • SHA256

    669473a93b985e40b8754db0190351ef2d1b33528e2cddb9d933e43ef6aa90c0

  • SHA512

    0fa0b62c455180011a3d84986caf71a9ed76e3fef7251a64ef9df1749e314336254e278e59b48c13715df3485e75c0df685835bbd5ef6dbe31427a7dcf52447d

  • SSDEEP

    3072:XMoS8owhTpcc9fmDEh7ZwM990NPLudT4TVZZjZ8v2Wtj+aQ6MgqKaGWsfCuI4rJV:x/

Score
10/10
netsupportpersistencerat

Malware Config

Targets

    • Target

      Notice_17_apr_2468899.js

    • Size

      519KB

    • MD5

      cf6e5af0b38c8e28cb0cb0760845b6fd

    • SHA1

      8ed18fc48813e4df42704e7a71385930ec21ac2b

    • SHA256

      669473a93b985e40b8754db0190351ef2d1b33528e2cddb9d933e43ef6aa90c0

    • SHA512

      0fa0b62c455180011a3d84986caf71a9ed76e3fef7251a64ef9df1749e314336254e278e59b48c13715df3485e75c0df685835bbd5ef6dbe31427a7dcf52447d

    • SSDEEP

      3072:XMoS8owhTpcc9fmDEh7ZwM990NPLudT4TVZZjZ8v2Wtj+aQ6MgqKaGWsfCuI4rJV:x/

    Score
    10/10
    netsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks