Extracted

Extracted

• • Target

    Update_browser_17.6436.js

  • Size

    296KB

  • MD5

    6bc9eccb481ac65cac1938e7f9a2b7e6

  • SHA1

    1a975ed336ed6ce8da390ea48163f5886726b628

  • SHA256

    9b77ce9fb306d0cefc655ac7344838ec9484100b5353d5d73ef005db46b53369

  • SHA512

    e147814426d81ab2f7c77daebbaef3c2110188142aa877b4e514c5cf9a0b870b28f9613ed0f259d81b15c2b650673e3961c71d58e956d1ecfd049bd979b2617b

  • SSDEEP

    3072:4OpyDJu8XUtQQSO1T7cbF/nlz3wq2B9OpyDJu8XUtQQSO1T7cbF/nlz3wq2Bp:lcJ6QhO1T7cZd6BYcJ6QhO1T7cZd6Bp

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2