Extracted

Extracted

• • Target

    d06badadda96772a16953e651c94ad5f9a51ae3b4666652f29905468d17a49d2.js

  • Size

    72KB

  • MD5

    3a69b775de7013377dd08f63f21d78a0

  • SHA1

    a34cf3f06eed1b0ae9a2eb9238a1f15732536434

  • SHA256

    d06badadda96772a16953e651c94ad5f9a51ae3b4666652f29905468d17a49d2

  • SHA512

    3c3857056145aca432a413e9420ef9a81f8854d3d81cb554567af58b4908c442b530093d52e8e63201ea2bea37649d4ac7a36b5d83dc4332132ebc1521202acb

  • SSDEEP

    1536:ic2kW+MIcufV9mKs8jVka5UY9ViwIEbLYczR+DtzHLx0ouieW3ZuCNN7rUofK9Dy:mkNVpUY9VPIkLYczR+DtzHxuieIkCNNV

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2