Extracted

Extracted

• • Target

    54596915c165e9ae886479fc31be46e2dceb96fd5ccf8ee5f066a3c14aff0cb8.js

  • Size

    71KB

  • MD5

    cc08bba3fcc009404a73f005bc9c1415

  • SHA1

    d97b5735a4f8894cbb35bce8a1d4951b474bb83b

  • SHA256

    54596915c165e9ae886479fc31be46e2dceb96fd5ccf8ee5f066a3c14aff0cb8

  • SHA512

    92b8f6f3a21de96c3b677cfea6e13cc25478a78bc75b745fad7807a64a8f9bc0fbb722b53449ff2a825ba698f9a40bb9667157579ff77f2387cd86c0266f5775

  • SSDEEP

    1536:JjEZbBm6Ei/98xM1OS95FlmheJi1D46IMayMP+vq:JYfZoS95FlmoJil46IManP+C

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2