Extracted

• • Target

    09631899.js

  • Size

    48KB

  • MD5

    5540af7a1007bc30cd464091fee2535a

  • SHA1

    d1de30a48a76730c69c8024186e9c4bf590d9434

  • SHA256

    18f2356888cd0909399b77211c732a3f808b06b4fd740e32c5e8105193296706

  • SHA512

    5095a8d0c1fa9fe07d522321912590f2a33234e0a63c4425412c74f3fddcfaa4de4c149c6e207ad978677e786c58eab5a1669ef366c27ba05120868d72cec291

  • SSDEEP

    768:vxQhlo7LD/J8Bvpt00L+/R0IuVJCzujMQ:J4m7LD/J8RpoRM

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2