General

  • Target

    920920920.js

  • Size

    3KB

  • Sample

    230829-kbzlnsba95

  • MD5

    3f2167d9176e11be1fc719b162ea8f7f

  • SHA1

    c051599496b4f1566df1144a884f4319c9eeb995

  • SHA256

    c11e8d463e3f93567094ff9ee4e15dfe069a55c57aa0a9fcca14217f8b25f7f3

  • SHA512

    4929c3a324971510f47c12f8c468ab087c8c84ff3fcf8961ad0fa7791aedc441b8f463a94b8c02b5987356e00137903085e06fbeaa9923f0887e66743bcb6418

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://instalfrio.cl/destination.txt

exe.dropper

http://instalfrio.cl/destination.txt

Targets

    • Target

      920920920.js

    • Size

      3KB

    • MD5

      3f2167d9176e11be1fc719b162ea8f7f

    • SHA1

      c051599496b4f1566df1144a884f4319c9eeb995

    • SHA256

      c11e8d463e3f93567094ff9ee4e15dfe069a55c57aa0a9fcca14217f8b25f7f3

    • SHA512

      4929c3a324971510f47c12f8c468ab087c8c84ff3fcf8961ad0fa7791aedc441b8f463a94b8c02b5987356e00137903085e06fbeaa9923f0887e66743bcb6418

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks