General

  • Target

    scan70.js

  • Size

    52KB

  • Sample

    230601-p73enaec92

  • MD5

    075a2625ce37c413d2354b660c77d165

  • SHA1

    8530731ad2aaede64dfd92492ac268bbb1b0bc8a

  • SHA256

    909908451fb3ff2969bd05e7409f055b6f3565041a3a7ec93f236fdfc4a6937b

  • SHA512

    0cf23bd555b118e6f4165ff6bddafdd8b17fb6dbf8490b55432e63f93b160026b1d7fc9aeb5f0e39223db490aebf2f616c03b1622a80a9b13ba69d591c487ffe

  • SSDEEP

    768:Z0yiO6JkUdDEeEpLMhWvhwEGZPlp8nmV4GKaRbw:ZDiRBjYRG98Kjlw

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://www.snappyshop.it/img/index.php

Targets

    • Target

      scan70.js

    • Size

      52KB

    • MD5

      075a2625ce37c413d2354b660c77d165

    • SHA1

      8530731ad2aaede64dfd92492ac268bbb1b0bc8a

    • SHA256

      909908451fb3ff2969bd05e7409f055b6f3565041a3a7ec93f236fdfc4a6937b

    • SHA512

      0cf23bd555b118e6f4165ff6bddafdd8b17fb6dbf8490b55432e63f93b160026b1d7fc9aeb5f0e39223db490aebf2f616c03b1622a80a9b13ba69d591c487ffe

    • SSDEEP

      768:Z0yiO6JkUdDEeEpLMhWvhwEGZPlp8nmV4GKaRbw:ZDiRBjYRG98Kjlw

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks