Extracted

Extracted

• • Target

    f4f502babf154a30ec9471ffad66e929c29c1a49f2cf8989d7b6b520abd39ed4.js

  • Size

    68KB

  • MD5

    dec439b782e39c10ce75a5a3d488153e

  • SHA1

    8ed49b64f2f5cfdd55db453d0227cf6eae4503dd

  • SHA256

    f4f502babf154a30ec9471ffad66e929c29c1a49f2cf8989d7b6b520abd39ed4

  • SHA512

    a86658ab3d0889c5a8a4af98d3998447f0a6fca5f1822b4bc71da128bb4bf7cc553b764c99bb48e17461f28f5a55728d66eaca8a0fa7e9b881d1ac5fca2b55a5

  • SSDEEP

    1536:GwoEPQRRVn6C4kx4qO3dNCfKpCMnbxk+8KCgZwFe3VekKZUCDObPysb3j:+WjkxEdEH+VvlZwFe3VeZ57srj

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2