Extracted

Extracted

• • Target

    8bd1f95d00d535db6a1869698126765591d255a8f6f266c7c1206d086e20dc0b.js

  • Size

    73KB

  • MD5

    ecdc89a5204f096f9e68b8a265b405f7

  • SHA1

    d4683d0f03c6cdf4f11afb5652c6602251f15c8b

  • SHA256

    8bd1f95d00d535db6a1869698126765591d255a8f6f266c7c1206d086e20dc0b

  • SHA512

    5d5662f26d52c35981f267ec9d4c4301676431011318b40b89356e8c4029379054fd3c8d2354bf5538479aff3d7f038c4f3b9b211cb479eda778c6fb3164629d

  • SSDEEP

    1536:KVECTjrnMOFam4ARPwXlHVoPPO9eYxPGAO2UMw/+B3M4Rkw8rcjQlleg:KVECTjrpFaWAlHiPPO9fxPGAO2UMw/8a

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2