Extracted

Extracted

• • Target

    a1cad1cb52b72c86925e612e05ef7e25372b880c46ad26091879206d6149c8af.js

  • Size

    72KB

  • MD5

    f3f9f0917ae1f7eccab673d03b7920b7

  • SHA1

    25199b53272a48bfec65b372f8ea380c2940730b

  • SHA256

    a1cad1cb52b72c86925e612e05ef7e25372b880c46ad26091879206d6149c8af

  • SHA512

    5fb9673ec5c3cdf5e5dc5d2c835733d25fbcfa24e466d49bc06ac4a951f29ae3809de93333689491a63c006a0628d23a6d543b713d978ac87e96badd2644383a

  • SSDEEP

    1536:um22QRkoft4s0rkn5oEV3KQ4G1QrFylAe0wucR58Xh1G/fQF:um2jEYVDdQrFyl4ub8Xh1G/fQF

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2