Extracted

• • Target

    cd878585f2e6447f52d1ccba5ae7739c55d8e441dde781548229dffe71e94319.mal_

  • Size

    5.2MB

  • MD5

    d9dddf370ea4db7a0ef38c35cfb16375

  • SHA1

    ce1e20428a625a32123ade0effab2ab51944df7d

  • SHA256

    cd878585f2e6447f52d1ccba5ae7739c55d8e441dde781548229dffe71e94319

  • SHA512

    46a967a055dc8bb89c2d830ab125c7e0172880b700e33131f0a714492f46e74940b350c85aff37c99bad5a01513244dfb2861f30c612e3f685ce0d7eb87f7abe

  • SSDEEP

    24576:ndtGeTldtGeT5xr4RQgdxxr4RQgdd3a00cpt9i3a00cpt95:nvlv51gdx1gdd3bFi3bF5

  Score

  10^/10

  netsupportdiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2