Overview

overview

10

Static

static

1

412241224122.js

windows7-x64

10

412241224122.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    412241224122.js

  • Size

    3KB

  • Sample

    230829-kjvbxsed7z

  • MD5

    e9f56e70b5ee1c6feab3c2377016bd0a

  • SHA1

    38e3089fcf756678c472ba132ff40ef6f1a276ac

  • SHA256

    b057a2c0094458982b81dac886c53a6753e7c0b73b8fcb21fa2bda1caf0e7793

  • SHA512

    8547a4912924b4d99ad0076b9c4b96d3da6294dda6a6bee1d897ce4a7753d6b0d38085b63dfcd07d1cce1fdbafc2f2903bce21a577de2d22d8623ac095070d6e

Score
10/10
netsupportpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://instalfrio.cl/destination.txt
exe.dropper

http://instalfrio.cl/destination.txt

Targets

    • Target

      412241224122.js

    • Size

      3KB

    • MD5

      e9f56e70b5ee1c6feab3c2377016bd0a

    • SHA1

      38e3089fcf756678c472ba132ff40ef6f1a276ac

    • SHA256

      b057a2c0094458982b81dac886c53a6753e7c0b73b8fcb21fa2bda1caf0e7793

    • SHA512

      8547a4912924b4d99ad0076b9c4b96d3da6294dda6a6bee1d897ce4a7753d6b0d38085b63dfcd07d1cce1fdbafc2f2903bce21a577de2d22d8623ac095070d6e

    Score
    10/10
    netsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks