Extracted

Extracted

• • Target

    c842f1d233e8f298aa3ee7d7b6e8e890474f9acf7ec18b4da07e771d3be323f4.js

  • Size

    64KB

  • MD5

    f6348f862b8f28e11adbf34af26b6159

  • SHA1

    e974cab2e791d8d9d403ec4bac9a03e3e936392f

  • SHA256

    c842f1d233e8f298aa3ee7d7b6e8e890474f9acf7ec18b4da07e771d3be323f4

  • SHA512

    9cdb49496c9ede1f275df93df89476cd6de424419058d6a2a3e0db22a98d6248ce9cba180927723bc22beaeb82b733c59f5ade8d38b5773536efdddb0bd745bd

  • SSDEEP

    1536:xz+pSx9UjeO+rANwbKkpddIVEZDZ/yMl+QQiZkkBLAoEUETvSvKCHCCD5V3KxFEC:AK9UjeO+rAqbKkpddIVEZDZ/yMl+QQiY

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2