Extracted

Extracted

• • Target

    DE-29022902.js

  • Size

    55KB

  • MD5

    8d414a76cdc1f8ba750bd9d48196a50a

  • SHA1

    eff9b4008ec33858f7a337d79886780b07d732e3

  • SHA256

    d601e8785756e05dc7dd7223476a5b75fd0bc6c6dfb84cff7faf00d2608b5b01

  • SHA512

    e5e575f5dd6712491b848a172112aa6ba75603e65d7fd64236aa91a0a1b1ae2995513621cec92fa40eec8e04e32b8d6d050130526ca0194c2984bdfb3c6afeba

  • SSDEEP

    1536:VWpAfwGN0EeAQANwU4IvY8wlSc2YIFmusUICE6:VZYGEAQANzY8wlxH8E6

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2