Overview

overview

10

Static

static

1

scan_doc_000_218.js

windows7-x64

8

scan_doc_000_218.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan_doc_000_218.js

  • Size

    2.1MB

  • Sample

    250212-s3dsaaxpht

  • MD5

    5d70053eb2dc41877d3228a3b608beda

  • SHA1

    0801a8635531e6cd3ed8198ea76195506d52ca9b

  • SHA256

    18af6d42fb413fe359d310236ed41059122adc11bcc7464ed55a0aa108bcd477

  • SHA512

    417bce4fe66db21082a33646531d4a3ee9a329b36eb4bc7edcbf316a4e2770c7894c9f21a57df2e192f9ca64842ba70c21dc48d3a2021a46cd4b5f8613b464a4

  • SSDEEP

    49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/8NhQQ7Ri9AH:h53S5V

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      scan_doc_000_218.js

    • Size

      2.1MB

    • MD5

      5d70053eb2dc41877d3228a3b608beda

    • SHA1

      0801a8635531e6cd3ed8198ea76195506d52ca9b

    • SHA256

      18af6d42fb413fe359d310236ed41059122adc11bcc7464ed55a0aa108bcd477

    • SHA512

      417bce4fe66db21082a33646531d4a3ee9a329b36eb4bc7edcbf316a4e2770c7894c9f21a57df2e192f9ca64842ba70c21dc48d3a2021a46cd4b5f8613b464a4

    • SSDEEP

      49152:h9NJObOvh90Wg1rA536egzhhCkrn14teMrxsi+ESK7OthvVKV2Mf/8NhQQ7Ri9AH:h53S5V

    Score
    10/10
    executionpersistencenetsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks