Extracted

• • Target

    ba583aa6128b64d9c417f5463d6716aa6d112c77cc69e9a643dafa8fb7738b99

  • Size

    2.6MB

  • MD5

    e9af416c1c0773cb7a689c8a58ee5150

  • SHA1

    482c487c48694e335832024d93b575ecfb7c0d2b

  • SHA256

    ba583aa6128b64d9c417f5463d6716aa6d112c77cc69e9a643dafa8fb7738b99

  • SHA512

    2653d1b113562ec37d0c105006501aae0cc906bba123e376a85a2894885d66d5edc9669a6d930402875713d02df0fa9d05920078b5711fe162cf43c70ca3a2b6

  • SSDEEP

    49152:6sz6FvpOiHY7sz6FvpOiHYUsz6FvpOiHY7sz6FvpOiHY0:60WQ0Wp0WQ0W5

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2