Extracted

Extracted

• • Target

    DCS19011901.js

  • Size

    29KB

  • MD5

    0d0e14c18ac4db3bced742abbc1e80e6

  • SHA1

    44977720d24a921e3b5cc52aadb99e8531a6985a

  • SHA256

    87d72fac49d1573f32930344a6be4ea18c0409a2b8f0a53c2e0f5e0d57b49459

  • SHA512

    3525f05b82e085ce67f43ad2f7f0168928a00122e1b86a1432f0e242532121e4160bbc0d81fcd2135d2dcb355d9535c5c5a300dcf3341ec875cf22840346c649

  • SSDEEP

    768:NPnwrYNgIqAEAU5s1ZuRl+30XxVUlA5Oxay7HCA+4TJUwnbmZrLMqNcWgRb3KBBB:YVMKEiZNoa/TAC

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2