Extracted

• • Target

    06345999.js

  • Size

    60KB

  • MD5

    8189d2de48c65f16e5f9a1e27cf6b53d

  • SHA1

    2b4cf31128f780b9b9efe98fa7e3921277b70197

  • SHA256

    b701b7d7b422726d96c25c50d7a5989ebadc641cdc95f8e1b97e6752c7c112a4

  • SHA512

    5cc1440a6aec6d5aab8d7bd4015b3cef0ca39e12c5ccfd6b69c691d32f9d31621e7fae878cd509a193ea6ae103fa18fde4edee7f345a6aee07b7e6346737c165

  • SSDEEP

    768:wvcaomCt7cyFwu6MfJHN4V5DaYz+HsMceNeRcU:BnVcEIMU5BzcJ5NU

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2