Extracted

Extracted

• • Target

    d14540001eb6bb57cff3d52a7898963c34ba6dffdb64ff05f4a1a7358b786e58.js

  • Size

    71KB

  • MD5

    ae23a12c8831e037b8709fad9294a3b6

  • SHA1

    8253709b658abdb6a6519fba7e43ca5c5f475e36

  • SHA256

    d14540001eb6bb57cff3d52a7898963c34ba6dffdb64ff05f4a1a7358b786e58

  • SHA512

    176715387ba9e8ed0fd71fefb510cac2bac97a3882328e715de6c04f3213804d7f616e554c8f91207ebbdc734ba866cddb2c1790b7d1bcc9ffdd593c4475c6b0

  • SSDEEP

    1536:dQ7ry9WhJ0vjA5ImvfctsfMrW0ObFftzs2Lq2+NhoYLl3nZX6wgPs:dQq9qJ0XmnZMs5lPq2IhoYLl3Zzws

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2