Extracted

Extracted

• • Target

    3e07933c4830d400b84d93031d973ac2850e4f2b6f304b7eb149a89ebb1a7556.js

  • Size

    70KB

  • MD5

    e0dd1cadb8a3e4b5b3de34f15643d91b

  • SHA1

    ea4612726a886beba2bf0a94314c02c6f8ecb97e

  • SHA256

    3e07933c4830d400b84d93031d973ac2850e4f2b6f304b7eb149a89ebb1a7556

  • SHA512

    66f884ccf7248521b3837dc368c255fdec671b0c038e73de022361ab430b737b262ec93c347960f04c3bf5c70773453ae798c006537f3fff6caceb6594a932c8

  • SSDEEP

    1536:AdD4iOzelUxOK1UmTbRnn0Af2H0e1cqO5tYPzhmwgCNREPjLSpu:AdD4iOzeKxTUmpnnVf2H0e6qO5mPzhmV

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2