Overview

overview

10

Static

static

1

449644964496.js

windows7-x64

10

449644964496.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    449644964496.js

  • Size

    3KB

  • Sample

    230829-j8z32aea7w

  • MD5

    5be1f9c99ebc9bf6d9ed0f51c39adb51

  • SHA1

    0961075f9d5e712d3be0c5a54ffc33fe182c6bb3

  • SHA256

    db599b0b7b3954b829dd48f70adf705f7a615b0e9192bb2c6cc769a6db8576e9

  • SHA512

    40ac746974f1b6a12a12ed6a5a6b405891cb46d42d71da3a477e99936efbd9aaffa318659ca87c55130f01d87f75a11d30737c063cfc7495de40058a3c3d694a

Score
10/10
netsupportpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://instalfrio.cl/destination.txt
exe.dropper

http://instalfrio.cl/destination.txt

Targets

    • Target

      449644964496.js

    • Size

      3KB

    • MD5

      5be1f9c99ebc9bf6d9ed0f51c39adb51

    • SHA1

      0961075f9d5e712d3be0c5a54ffc33fe182c6bb3

    • SHA256

      db599b0b7b3954b829dd48f70adf705f7a615b0e9192bb2c6cc769a6db8576e9

    • SHA512

      40ac746974f1b6a12a12ed6a5a6b405891cb46d42d71da3a477e99936efbd9aaffa318659ca87c55130f01d87f75a11d30737c063cfc7495de40058a3c3d694a

    Score
    10/10
    netsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks