Extracted

• • Target

    Telex58734.pdf.lnk

  • Size

    1KB

  • MD5

    ee0e01d5cde42c26bba7e8b06380c146

  • SHA1

    042c5bf844185917bd38d86b88640656b8710c2b

  • SHA256

    b137bcb29d0d26422581e4e556bc1f9f29096d21de865c7d1a3e945434edd07f

  • SHA512

    2af9903fb458549dab35e290229d62a68f692dacb3515d66e092b86bc24e8e4c4e79c80ab6d0df42a0e11365f27ece414acc04f4932f23dd588ce89e89f98831

  Score

  10^/10

  netsupportexecutionrat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1