General
-
Target
920920920.js
-
Size
3KB
-
Sample
230829-kbzlnsba95
-
MD5
3f2167d9176e11be1fc719b162ea8f7f
-
SHA1
c051599496b4f1566df1144a884f4319c9eeb995
-
SHA256
c11e8d463e3f93567094ff9ee4e15dfe069a55c57aa0a9fcca14217f8b25f7f3
-
SHA512
4929c3a324971510f47c12f8c468ab087c8c84ff3fcf8961ad0fa7791aedc441b8f463a94b8c02b5987356e00137903085e06fbeaa9923f0887e66743bcb6418
Static task
static1
Behavioral task
behavioral1
Sample
920920920.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
920920920.js
Resource
win10v2004-20230824-en
Malware Config
Extracted
http://instalfrio.cl/destination.txt
http://instalfrio.cl/destination.txt
Targets
-
-
Target
920920920.js
-
Size
3KB
-
MD5
3f2167d9176e11be1fc719b162ea8f7f
-
SHA1
c051599496b4f1566df1144a884f4319c9eeb995
-
SHA256
c11e8d463e3f93567094ff9ee4e15dfe069a55c57aa0a9fcca14217f8b25f7f3
-
SHA512
4929c3a324971510f47c12f8c468ab087c8c84ff3fcf8961ad0fa7791aedc441b8f463a94b8c02b5987356e00137903085e06fbeaa9923f0887e66743bcb6418
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-