General
-
Target
694269426942.js
-
Size
3KB
-
Sample
230829-kftk8aec6t
-
MD5
cb3da677e950ad8e8ebc712504d97f23
-
SHA1
77e2b7acb153c90580d47acf4688550a4e202bbd
-
SHA256
845bbda7f09604af9b7021510ac1d29f3fef73153532c66164d4960b99c47a6a
-
SHA512
25948025241043a797b280fc2b5c75661c174580f88a89d48dd9d62b10cfa99628f1a4db74f7b337b3fe40fbf81dc619d47b3fff539b3f28c8d6d593178802ff
Static task
static1
Behavioral task
behavioral1
Sample
694269426942.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
694269426942.js
Resource
win10v2004-20230703-en
Malware Config
Extracted
http://instalfrio.cl/destination.txt
http://instalfrio.cl/destination.txt
Targets
-
-
Target
694269426942.js
-
Size
3KB
-
MD5
cb3da677e950ad8e8ebc712504d97f23
-
SHA1
77e2b7acb153c90580d47acf4688550a4e202bbd
-
SHA256
845bbda7f09604af9b7021510ac1d29f3fef73153532c66164d4960b99c47a6a
-
SHA512
25948025241043a797b280fc2b5c75661c174580f88a89d48dd9d62b10cfa99628f1a4db74f7b337b3fe40fbf81dc619d47b3fff539b3f28c8d6d593178802ff
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-