Extracted

Extracted

• • Target

    f6f462ce3420721369633b2feccd18c7d3c0f228629b671c398b675f0eb37e1b.js

  • Size

    65KB

  • MD5

    ba20b18214a0fa85b9550a3c3b1fa357

  • SHA1

    9b09c256f2373a17e4d612af88f5e3889716ba8d

  • SHA256

    f6f462ce3420721369633b2feccd18c7d3c0f228629b671c398b675f0eb37e1b

  • SHA512

    17e8ac3f8f1666935249e389d60f32036a375f663b9eff7c2c7b31f0fa287d0ee9d2d6869880051b0efd29f717de537eea99bee95ebe2c255501fe112024b150

  • SSDEEP

    1536:eA/QaaX7EVdd2kw8ZTeo+PUtCbCgVxAop6yYFBgnJ1A:em9q7EVdd+8lWgxBop6y22bA

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2