Extracted

Extracted

• • Target

    7d273aa816e948999220ac2f30401a3aafd3a19029fa3633ff1ea2f0c50cc676.js

  • Size

    68KB

  • MD5

    f881c6fcfb905a072881ab5226001823

  • SHA1

    4aa8b84a1046e71b207ee1c55e5779e5bfccc7ee

  • SHA256

    7d273aa816e948999220ac2f30401a3aafd3a19029fa3633ff1ea2f0c50cc676

  • SHA512

    8f67446fb7c66606f5d771c1f239a07b09ebe65ecffb05f16e5b8353947f8912929606569d747060843df9d0d9ac9a0724e336345085124dcad64fbc9608d1a5

  • SSDEEP

    1536:E7tsM18VEoS5Beww2mW21v7IOF3U88JCwJpxB3T/pyF5:2aVEoS5Beww2mW21vMOF3QJCwJpxB3Tk

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2