Extracted

Extracted

• • Target

    da13cd92728c03754d8d81783946bc936d078669af24cbe4133f72c0ae14e2ae.js

  • Size

    69KB

  • MD5

    03c05690015beed115f741bbdec26e7f

  • SHA1

    c2302e2f4bbfacaf4bb58d20d57f05c85ac73fc9

  • SHA256

    da13cd92728c03754d8d81783946bc936d078669af24cbe4133f72c0ae14e2ae

  • SHA512

    ec8703385e064eb9f16ef531859799fc580d21bdb4ba40ef5a3beb0f6366efb040880aeb7ed94c078db3dfd0218ffa250aea2626996ea1dfd37d61054ef3865f

  • SSDEEP

    1536:YP6Y/yqieroJXPA/FNAu5nVg0lq52A/U5oZtytEMwGOM6Sl8Ppx:e6Yqq/oJ/EzzY2A/CozUEMPOM6Slkx

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2