Extracted

• • Target

    empl2530.js

  • Size

    51KB

  • MD5

    f0a018c1ef4ec29817788453a36a2ba9

  • SHA1

    31f091037d7cf8675ce593864fda8d3a7c70258e

  • SHA256

    0bdf78ab1e637ed039b10c63a1ecf30095acb9ed108726eb6010fe7471ff1ec4

  • SHA512

    3985ac1c359e5483a2a75d9c59b15b4ce8d2ac76c002b83a0045719abbddaebe7ec9302f09c6bdda0c989a89cb1a5c57286d24c727abe41c47813d1ea4efb9f1

  • SSDEEP

    1536:BsuYuVi2keOJee2NDIlUF0d9U77D6+T/I:euYuVLkeOJsk+F0d9mv6+T/I

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2