Extracted

Extracted

• • Target

    a39de8933347e938b54c91d53e1e8b12e26a5d26e4afa29a8ce797363642fc87.js

  • Size

    70KB

  • MD5

    86a544b80751c23778041d0f2491dce3

  • SHA1

    bf1c959a0bf0dcc1452a93977305d124ae6f9154

  • SHA256

    a39de8933347e938b54c91d53e1e8b12e26a5d26e4afa29a8ce797363642fc87

  • SHA512

    8dbc58a6aba12a5988adf8bcdff1f5a45d26057fc81366bf7bc380c5c728e992c5a1a5cf08f370003f894f09a183bcf7aec75d94fb9235ba4d12f75d5de35262

  • SSDEEP

    1536:LHs3dKKIBrOVux3DFypWgfwKLQP0wgqgFEk4xrEBfTkA5SMG9B2Vn5M0UuQwbuI8:wNKKIBrOVux3DFypWgfwoQP0wgqgFEkW

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2