Extracted

Extracted

• • Target

    c31b0a69e3c2cdb394754dbce34aaba8e79e809285177faffdb1506b6f05a01f.js

  • Size

    65KB

  • MD5

    5a386788ea13ca8f516f3a304c3b13fa

  • SHA1

    8e3a1bda560808459e5938afa426f84ba3acfeb3

  • SHA256

    c31b0a69e3c2cdb394754dbce34aaba8e79e809285177faffdb1506b6f05a01f

  • SHA512

    2480cc7b183529906a59ceb02a712b07b1e33ec9fcf77db367e0c374f7a0d437fde99454f8229ad5c9e676eee2866f70f6721df2d34e88a251367da267fada18

  • SSDEEP

    1536:ol33+qFCiH1CslxL7v3+AhFb0Er1U6h2DHXjW03apMFFfPQWQsNcl7VlH8aFCy8m:dqAC1CslxLL+0Vj1YK03aUfPQW3al7VN

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2