General

  • Target

    2996invcomp2996.js

  • Size

    48KB

  • Sample

    230601-f6knsacg34

  • MD5

    6d7df9776d3a0e83844107de6602db1d

  • SHA1

    217b0b054cc1415bcaa7ebb24d2ddca804b8dae3

  • SHA256

    f1512abfe1d5631268f1a45a17efa91c46302cfdf958588850d0a91adde8022f

  • SHA512

    f90612147f6771a93b25808cd38e6b0d3aec5f6d9d8d85498510b9d468d36ea161cdd4dd9e9c54ae46b85bcedadfcff186929514a0058d80545c23a5d639942f

  • SSDEEP

    768:+MycWxNLaNbGBmlswGGoD3IrBQoSKMEGOCTsJhDjHU99hS+O3yihUdX:+rcWHaNonpdkMKMEGOCThq+OIN

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://www.snappyshop.it/img/index.php

Targets

    • Target

      2996invcomp2996.js

    • Size

      48KB

    • MD5

      6d7df9776d3a0e83844107de6602db1d

    • SHA1

      217b0b054cc1415bcaa7ebb24d2ddca804b8dae3

    • SHA256

      f1512abfe1d5631268f1a45a17efa91c46302cfdf958588850d0a91adde8022f

    • SHA512

      f90612147f6771a93b25808cd38e6b0d3aec5f6d9d8d85498510b9d468d36ea161cdd4dd9e9c54ae46b85bcedadfcff186929514a0058d80545c23a5d639942f

    • SSDEEP

      768:+MycWxNLaNbGBmlswGGoD3IrBQoSKMEGOCTsJhDjHU99hS+O3yihUdX:+rcWHaNonpdkMKMEGOCThq+OIN

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks