Extracted

Extracted

• • Target

    9af1e1611a6b0e8fc4fb5c63e36baceb315a6eb38450d2ae8525e21f468043d0.js

  • Size

    69KB

  • MD5

    ad3ac6fce54e6401660fac2b1389e482

  • SHA1

    b1be7f458113971808e7e71f0074d1304d9d0af1

  • SHA256

    9af1e1611a6b0e8fc4fb5c63e36baceb315a6eb38450d2ae8525e21f468043d0

  • SHA512

    963c9926720f9c0c0c7284ccd65a56217263df8c92aa4a90a21fddd2cbc9802fc24216469dc55e2ad329e442fc52fcfbad0991f424c092eefeea79e9d971badd

  • SSDEEP

    1536:P7K8Pc0reSVDFMi/gra8I7dootq56npg3qOWgcRXCqZ/lo8o+0:P7OPquwFmotqepaqOWgcRXCqlZX0

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2