Extracted

• • Target

    netsup_clean.ps1

  • Size

    423B

  • MD5

    cb2f8714d903ee68eaaa52b78261eb00

  • SHA1

    5a6ce4f8cd4ad17859d11c5c3b136185ef7afbe3

  • SHA256

    93f204a36a7f6ac6c77d1fa6aff94f05d40a1cccc0b76c7740e622ac3182c531

  • SHA512

    124a37ff5c2fcbb5a601621e2ff6642ed732e389eda95cc4fcf6ad8ba9b17a6899dcdec32a2e3138d0c400b7effcfa2483aa823ce42a04bd1e4c849213c628c5

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Netsupport family

    netsupport

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2