General
-
Target
2996invcomp2996.js
-
Size
48KB
-
Sample
230601-f6knsacg34
-
MD5
6d7df9776d3a0e83844107de6602db1d
-
SHA1
217b0b054cc1415bcaa7ebb24d2ddca804b8dae3
-
SHA256
f1512abfe1d5631268f1a45a17efa91c46302cfdf958588850d0a91adde8022f
-
SHA512
f90612147f6771a93b25808cd38e6b0d3aec5f6d9d8d85498510b9d468d36ea161cdd4dd9e9c54ae46b85bcedadfcff186929514a0058d80545c23a5d639942f
-
SSDEEP
768:+MycWxNLaNbGBmlswGGoD3IrBQoSKMEGOCTsJhDjHU99hS+O3yihUdX:+rcWHaNonpdkMKMEGOCThq+OIN
Static task
static1
Behavioral task
behavioral1
Sample
2996invcomp2996.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2996invcomp2996.js
Resource
win10v2004-20230221-en
Malware Config
Extracted
https://www.snappyshop.it/img/index.php
Targets
-
-
Target
2996invcomp2996.js
-
Size
48KB
-
MD5
6d7df9776d3a0e83844107de6602db1d
-
SHA1
217b0b054cc1415bcaa7ebb24d2ddca804b8dae3
-
SHA256
f1512abfe1d5631268f1a45a17efa91c46302cfdf958588850d0a91adde8022f
-
SHA512
f90612147f6771a93b25808cd38e6b0d3aec5f6d9d8d85498510b9d468d36ea161cdd4dd9e9c54ae46b85bcedadfcff186929514a0058d80545c23a5d639942f
-
SSDEEP
768:+MycWxNLaNbGBmlswGGoD3IrBQoSKMEGOCTsJhDjHU99hS+O3yihUdX:+rcWHaNonpdkMKMEGOCThq+OIN
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-