Extracted

Extracted

• • Target

    adece19c122b2d32188a9518225acd46aa48546c38d1edcac1beab8b07c0d108.js

  • Size

    69KB

  • MD5

    d9157cd51b372caebe639defa7fa93a2

  • SHA1

    d5977d9de34ccd5f5dde67d14cb11c236063ef9c

  • SHA256

    adece19c122b2d32188a9518225acd46aa48546c38d1edcac1beab8b07c0d108

  • SHA512

    d6554f171d8d2ded72d23034621886fba4f2f7a176b477349f573c3a18d8ed29c4477f777821c97f87549641261d49c404ca1163f0b8ebc7168033b128e6d2bf

  • SSDEEP

    1536:5dw3MCXHg6wPezOK72C8NMlpMJyZ1uLSOZGemk80iuS7pKD28itFk:w3M0twPezOC8NkyJl/ZGemk1i5YNUi

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2