Extracted

• • Target

    5342fa80b4f8f983322e8932819ef6037f837b93719a77f06f48d4a6eb7b17f8.exe

  • Size

    28KB

  • MD5

    665aba35929da6cccc28ee3462c46187

  • SHA1

    d8b04407b2807f0fc078e6bd47b6ed4a71d0b16b

  • SHA256

    5342fa80b4f8f983322e8932819ef6037f837b93719a77f06f48d4a6eb7b17f8

  • SHA512

    19e132a5b23bebe4795af6a57e7958267565f18c7a83419d02bfad26ca222ddbec4479f7270e0a96612adfb470a51d9622354938a554db33360b45e03eb37b62

  • SSDEEP

    384:pZs2bjAkOzFGbIki9U2ZPrgghNPe6ki2kUix6LkCzHDH/n/RJGBkSFX:pyi9oZkirZPrg2RB2Ex64CzHDHf/ckg

  Score

  10^/10

  netsupportdiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Netsupport family

    netsupport

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2