Extracted

• • Target
    79d564f2de35ca6b1b9d78498019b00f8b3a0b231d619317cdf3bdf2615ba0aa
  • Size 13.8MB
  • SHA256 79d564f2de35ca6b1b9d78498019b00f8b3a0b231d619317cdf3bdf2615ba0aa
  • MD5 9bf4be608d90edf6891ce6b99b9db4cb
  • SHA1 443e8e9c857c554e5723bc6b408bf8365b450749
  • SHA512 2b84c254971ece8d18c3c3ab36fe32976c279c15463e7704302ba2baec913f1c308e09970935ac6bc75b2f4a879ef6bfb510ae70230a3c6d5b2f7234a657ab13
  • SSDEEP 49152:87V7zjCxbzqHlp4LhyN0kghDzLZzjYzYsmCW+8z2V35//9SGGqHm3quVIKXgxcE/:6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionnetsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2