Extracted

• • Target

    Rechnung3777686 M3605066 TEU3777686.lnk

  • Size

    69KB

  • MD5

    234122cf935c5dfb99690848542920f0

  • SHA1

    e1830914af3a5c7968c08afbbe70c931b05987a6

  • SHA256

    f40766eae36bc156e1d05e52d6763b0e80c6adbe91518e76acb3c095fc1514cc

  • SHA512

    10bf42180bc776a346c4ad9e63380001db39ab83ad5caf137f5ac5f91776d5ab12fd4607e9ca674d41dc452a0be6bc3693038b3335be14a35cbd8f0933d21618

  • SSDEEP

    1536:ChHIEFR+bfF3TuA19ow8DPZ4pxXW47NhdEmfjwR6Wts3L75cF:6nFUF3N1P8DPyxB0sxbS

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2