General
-
Target
scan70.js
-
Size
52KB
-
Sample
230601-p73enaec92
-
MD5
075a2625ce37c413d2354b660c77d165
-
SHA1
8530731ad2aaede64dfd92492ac268bbb1b0bc8a
-
SHA256
909908451fb3ff2969bd05e7409f055b6f3565041a3a7ec93f236fdfc4a6937b
-
SHA512
0cf23bd555b118e6f4165ff6bddafdd8b17fb6dbf8490b55432e63f93b160026b1d7fc9aeb5f0e39223db490aebf2f616c03b1622a80a9b13ba69d591c487ffe
-
SSDEEP
768:Z0yiO6JkUdDEeEpLMhWvhwEGZPlp8nmV4GKaRbw:ZDiRBjYRG98Kjlw
Static task
static1
Behavioral task
behavioral1
Sample
scan70.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
scan70.js
Resource
win10v2004-20230220-en
Malware Config
Extracted
https://www.snappyshop.it/img/index.php
Targets
-
-
Target
scan70.js
-
Size
52KB
-
MD5
075a2625ce37c413d2354b660c77d165
-
SHA1
8530731ad2aaede64dfd92492ac268bbb1b0bc8a
-
SHA256
909908451fb3ff2969bd05e7409f055b6f3565041a3a7ec93f236fdfc4a6937b
-
SHA512
0cf23bd555b118e6f4165ff6bddafdd8b17fb6dbf8490b55432e63f93b160026b1d7fc9aeb5f0e39223db490aebf2f616c03b1622a80a9b13ba69d591c487ffe
-
SSDEEP
768:Z0yiO6JkUdDEeEpLMhWvhwEGZPlp8nmV4GKaRbw:ZDiRBjYRG98Kjlw
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-