Extracted

Extracted

• • Target

    bcb732a5f458d792a47f2bd444d0c48d266db721f01450c539719a1e37653a13.js

  • Size

    67KB

  • MD5

    00de3913fd5e4bb0d9284b180bfbd956

  • SHA1

    6af05b012b8c828a42acf476a5e0332aa6c4bd9d

  • SHA256

    bcb732a5f458d792a47f2bd444d0c48d266db721f01450c539719a1e37653a13

  • SHA512

    f47a3cdd66286792fdde690268baa1f8b8776e3c619ceccd341421e4e63bfac26554db0f7b98b9ebba559b375d50a8498727bc7771d18b207fd1bf0c4255c684

  • SSDEEP

    1536:RZd77OUymTHj+bKqlqH79yuZ0aENJUWGkcXu+1LKPuJ7yNkZ7FXTh:R/aUyaHjqqH7ouZHmJUWvQEPuJ7ySZ7n

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2