Extracted

Extracted

• • Target

    6688ba0f6d277c34f47f6aaddcd4794f3d019f6aaf56caf07c18d56d5bc77c41.js

  • Size

    73KB

  • MD5

    b7de158113029fa1f14355c99f715ac8

  • SHA1

    638d00e2394cd5ac45d12aea3c7a708e01dcb3ad

  • SHA256

    6688ba0f6d277c34f47f6aaddcd4794f3d019f6aaf56caf07c18d56d5bc77c41

  • SHA512

    15e84ee92a5c9ec273955f4d94e2bd722c94e9051a7e36a27c9416f73eec9b05a1b072718bb264f47e204e4e4c7a9091d96c168d000ca06db22b4f1f105b40a1

  • SSDEEP

    1536:voChqle4yZ7K1Kho+QU0+xNUa4n33jcbo/MQsAkNn39vc5tgZF013:QChUyZ70K2+BSau4s/MQstNn3lc5Jp

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2