General
-
Target
rechnung_3210.js
-
Size
37KB
-
Sample
230519-psd4hsgf6v
-
MD5
ce1e7b3d978c78c930951a0cf447b68e
-
SHA1
3fb5daa6223b457f0a09c6796471661a0aeacc43
-
SHA256
1a9b3968a2f3a4ae0c9c51e6fc41a48829ac4a0fa118a7530c36715638ef0209
-
SHA512
d7821557ac99f9d19ebf5a1b7663f8a4964294a83cfb553513838971c6d7ab53b39e49e20d17f8a3f2356bdb9debb75a876b128d1a5efa032e7bb0938a77bcd5
-
SSDEEP
768:S4JoaqEwcYFSWKf2evS5+/7f2DZl62ax92hDXOuqgeyI4I:SdaqEHWfevS5+LkZrax0hDXdqg5I4I
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_3210.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rechnung_3210.js
Resource
win10v2004-20230220-en
Malware Config
Extracted
https://ridersintl.org/vincent-sewe/f1.ps1
Extracted
https://macayaywaak.cl/sistema2/variables.php
Targets
-
-
Target
rechnung_3210.js
-
Size
37KB
-
MD5
ce1e7b3d978c78c930951a0cf447b68e
-
SHA1
3fb5daa6223b457f0a09c6796471661a0aeacc43
-
SHA256
1a9b3968a2f3a4ae0c9c51e6fc41a48829ac4a0fa118a7530c36715638ef0209
-
SHA512
d7821557ac99f9d19ebf5a1b7663f8a4964294a83cfb553513838971c6d7ab53b39e49e20d17f8a3f2356bdb9debb75a876b128d1a5efa032e7bb0938a77bcd5
-
SSDEEP
768:S4JoaqEwcYFSWKf2evS5+/7f2DZl62ax92hDXOuqgeyI4I:SdaqEHWfevS5+LkZrax0hDXdqg5I4I
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-