Extracted

Extracted

• • Target

    35dc57c29fefd8ae274fafc6042dbb5d483c73bdf038dff35d03b220c9152fb8.js

  • Size

    71KB

  • MD5

    f5a0c62b4562d0767113b2c64e13827f

  • SHA1

    f788547c5bf999c23de94b8c4424ea7e7c6da1ff

  • SHA256

    35dc57c29fefd8ae274fafc6042dbb5d483c73bdf038dff35d03b220c9152fb8

  • SHA512

    d812be7bb4e6d8aa4de73f7578ed4b500156b2b1a7d20c8d2edcb02aa85de01ae743c658516278139a5ef8ba211bcb32a8c2a0d4cac8aace38fc9f3a388afc1b

  • SSDEEP

    1536:Gy9fnyXp2/hk77kRO+WjEwHuXB5o2In7mhvk8qvacF3qAY+aXjCerpa:tfyXQw8OREwSZqvacF3/pSjCD

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2