Extracted

Extracted

• • Target

    DE-94059405.js

  • Size

    71KB

  • MD5

    38173035f40ee1d01b71dc326a69a675

  • SHA1

    270164a80071fd82ef817b06934222b798fd5673

  • SHA256

    a9b92bc14580b2d4a5d7a21d5089944fa08e0746025df1a9d74b0522cf1e3069

  • SHA512

    034b5868e45e936d523dfb4c18b66a391e6a8434a59dec1c3645760d1d60d6e9422999210b6ee9a7ab8d75e30419d4432df31f59037b8c46bae4d122ea75bb4a

  • SSDEEP

    1536:3UFnyjPGV6d1vnq1Syz1QkQGCDbVuW+oet1X76ZIy/2Jyi0a0qb9i8TJBNTmElvg:3onyPGV6Zyz2LQtR76Cy/2JyiX0qb9iF

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2