Extracted

Extracted

• • Target

    2a6c67f8d62b335ae1d000be7e427a279911bfa98b28c2f886d602bb28f1b688.js

  • Size

    62KB

  • MD5

    e46c3f1cc23168063e57407b7a4f4a1f

  • SHA1

    be7c6d0ae556008de2799fbeee14445a1a60a5e7

  • SHA256

    2a6c67f8d62b335ae1d000be7e427a279911bfa98b28c2f886d602bb28f1b688

  • SHA512

    db7cdd134e401b0315b427e070a21e807fd38298b828d0de78e18191486c7fcb306c2d8d549975a7c67403724801213c4a512085b1c154130c34fdfd3438169d

  • SSDEEP

    1536:PxP8ZatXI/SQAjTLVcMkti+sDk9D6otJ0:PxU8FI/S7jXV8ti+sDk9JQ

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2