General

  • Target

    694269426942.js

  • Size

    3KB

  • Sample

    230829-kftk8aec6t

  • MD5

    cb3da677e950ad8e8ebc712504d97f23

  • SHA1

    77e2b7acb153c90580d47acf4688550a4e202bbd

  • SHA256

    845bbda7f09604af9b7021510ac1d29f3fef73153532c66164d4960b99c47a6a

  • SHA512

    25948025241043a797b280fc2b5c75661c174580f88a89d48dd9d62b10cfa99628f1a4db74f7b337b3fe40fbf81dc619d47b3fff539b3f28c8d6d593178802ff

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://instalfrio.cl/destination.txt

exe.dropper

http://instalfrio.cl/destination.txt

Targets

    • Target

      694269426942.js

    • Size

      3KB

    • MD5

      cb3da677e950ad8e8ebc712504d97f23

    • SHA1

      77e2b7acb153c90580d47acf4688550a4e202bbd

    • SHA256

      845bbda7f09604af9b7021510ac1d29f3fef73153532c66164d4960b99c47a6a

    • SHA512

      25948025241043a797b280fc2b5c75661c174580f88a89d48dd9d62b10cfa99628f1a4db74f7b337b3fe40fbf81dc619d47b3fff539b3f28c8d6d593178802ff

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks