Overview

overview

10

Static

static

1

Payment_198.js

windows7-x64

10

Payment_198.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_198.js

  • Size

    2.0MB

  • Sample

    250131-nyjqhsvkhz

  • MD5

    8628ad441bd6faefe0595cad2d6b6c8f

  • SHA1

    7292bb76c1872d06b9f38dbf8f40df44a06180ad

  • SHA256

    1fdf43c4b7b463410c3bc0ca5447061140127deeb5509e5029667620ad9e9d99

  • SHA512

    0eed38dfec4e22e24ce1771f1315f7a96a613ed8f97f64271280248930c9d6e779348ab1c97578560a39072bb1e901f024a43953b05f57626213d55164c5c818

  • SSDEEP

    49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/U:h53S5d

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      Payment_198.js

    • Size

      2.0MB

    • MD5

      8628ad441bd6faefe0595cad2d6b6c8f

    • SHA1

      7292bb76c1872d06b9f38dbf8f40df44a06180ad

    • SHA256

      1fdf43c4b7b463410c3bc0ca5447061140127deeb5509e5029667620ad9e9d99

    • SHA512

      0eed38dfec4e22e24ce1771f1315f7a96a613ed8f97f64271280248930c9d6e779348ab1c97578560a39072bb1e901f024a43953b05f57626213d55164c5c818

    • SSDEEP

      49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/U:h53S5d

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks