Extracted

Extracted

• • Target

    5dc075fa21c26a577e957f0998567325360feac1724129cc597fa066a7732ae0.js

  • Size

    58KB

  • MD5

    3564cec4227a927c5fbe75f6d7f16593

  • SHA1

    d5d17ca63dae059091907d1d32b30bae5b66bd47

  • SHA256

    5dc075fa21c26a577e957f0998567325360feac1724129cc597fa066a7732ae0

  • SHA512

    f9cacdc4393e4d1f2fba97c2b35fb22ea7b428d603d9f1ba696ff0aee8fda0241ef3141bb4c7083d4e4d1f33e91fa9d682341fa01dbae886a76aef28993dcde3

  • SSDEEP

    1536:DRqUVuL8zDZOcbTnzNIol0vcasq4BdhUGEYU:lqUV88XZOcbTnzNrlIcDq4BdOr

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2