Extracted

Extracted

• • Target

    Versandbestaetigung_155002_23098.js

  • Size

    32KB

  • MD5

    aacc50b6cb34a6464a811793fbbc9776

  • SHA1

    5e4bc0f6dcbd8687fd54d7c75584fc784e44cf3d

  • SHA256

    684bd7367b7f3365a7420b767632c453fa2ae68a937723cfc9b38a2381097ad6

  • SHA512

    b33090526297166e73b28a41a5503cb2d98f6b1e601db27af21ed4069ce5629a5d59297699a0ed715d2e00360eb917bd831b98ae753596e6b30fc114d8f443fe

  • SSDEEP

    384:pJ26gAE6CcsFVP8Nrpl3i+00+/hwaEV8dyXx9DCymMnOWesqoqAv4CCpuh6yEFUr:pJaWs0PFBVdXtriaCkeJ5LG7n5VVkm

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2