Extracted

Extracted

• • Target

    65ae8851b85eb4d3d5de22e9874782b63878ec23583bf966499c6cd60cc29400.js

  • Size

    69KB

  • MD5

    fac8939a18f37594282b6ef4d7d298ac

  • SHA1

    42eb7cad96826f4d112ad33e1b07787a8b9a8788

  • SHA256

    65ae8851b85eb4d3d5de22e9874782b63878ec23583bf966499c6cd60cc29400

  • SHA512

    dace577f41c834f3c0945a504b792fc11505d749ee332665683e6550f9411e36b823555d86bcd9ff692745a833f82e2f5be1800074ebe1a54164724565698cd0

  • SSDEEP

    1536:5wlL7IiE6/PyBMn50ejAVEYxjnJWMUE3G6prmsOWXgXyQPTcb:msiE6/HnCiAVEfE3G6prmsOWXBQPTs

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2