Extracted

• • Target

    c3d797e67edf0dd435808f2f79ff4bfd0cf9177307f4a112b7da09f7dfdd8f2e.txt

  • Size

    5.2MB

  • MD5

    a495fbc9b99c98d0a054e937d4dcb944

  • SHA1

    b2a2433591576985adce5da344d72ae669a9cc5f

  • SHA256

    c3d797e67edf0dd435808f2f79ff4bfd0cf9177307f4a112b7da09f7dfdd8f2e

  • SHA512

    67ffdf2a2541127bcd1cf05b8f4c47e99844fb9a01ec33d5ff538e6a176eade5636f20c096e783f5d1c5b849ec2ee952a89a3fc35286d1e0e1000c0a21d39c6a

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fuVCz4F9dM2furCz4F9dM2fu+Cz4F9dM2furCz4F9dMW:OkGgkGMkGgkGbkGgkGMkGgkG9

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2