Extracted

• • Target

    IN_20552055 CP_20552055 D2055.lnk

  • Size

    10KB

  • MD5

    93562b0626c4db0640dff594fdc44efc

  • SHA1

    33d9effa67cae9726124a3432e6913c324b8b716

  • SHA256

    a1739e001e0720341f14466231a21bd12a74485dab59b0f4fde7f931467cb4b2

  • SHA512

    edf748587ae68606935b495db2c78f9fe4e3198e69bcc7052fca66a14ff148f3aad5530688a715f4c9881783065b81951ccf4201e1f258f8f805eb6eee1e4c98

  • SSDEEP

    192:815xsY5jfxXWCBdMNi8L2+6gJuOLdFbi6ppeaHRz2ywmc2sm9Wt:w5Tfxb2ioggJuAr1waHRz2nrgo

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2