Overview

overview

10

Static

static

1

EU6696.js

windows10-2004-x64

10

Resubmissions

24/01/2024, 05:16

240124-fx5btsbdhn10

23/01/2024, 11:06

240123-m7vcyaadf410

Sharing

Copy URL Twitter E-mail

General

  • Target
    EU6696.zip
  • Size 10KB
  • Sample240123-m7vcyaadf4
  • SHA256 e7c06a549443b1aea924e62326edeb1ac4ee80699f5bc23024b1207ed5bece39
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netsupportpersistencerat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://hsdiagnostico.com/readme.php

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://core-click.net/TVFrontend/NSM.zip
  • exe.dropper

    https://core-click.net/TVFrontend/remcmdstub.zip
  • exe.dropper

    https://core-click.net/TVFrontend/DLAA1view.zip
  • exe.dropper

    https://core-click.net/TVFrontend/mock/

Targets

    • Target
      EU6696.js
    • Size 28KB
    • SHA256 bf309c56f147c8f73024569246dc6d38f912c93e5a0cbe2c688115dc332c2182
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    netsupportpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks