Extracted

Extracted

Extracted

Extracted

• • Target
    Setup/Update_browser_17.64531.js
  • Size 443KB
  • SHA256 f2bf9a151a6663d7c24d8a7c2d94b6133e9b32580bdeef8cd2ece054535eba26
  • MD5 c46c20eccf782a7d455344fea1c3b4c6
  • SHA1 3ab4cc125ab3307af32f58aef5a476e8320ed4f6
  • SHA512 097adb2745cb868af9a14360f06682409dae7ad428ec962be224a73301eb60ab665983016e002365def1721103389f7f6127b8f323048ebb19f4ac7485f00760
  • SSDEEP 12288:lqlI1T7cZd+2qlI1T7cZd+jqlI1T7cZd+p:lqlyT7cZdBqlyT7cZdOqlyT7cZdS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    Setup/Update_browser_17.64532.js
  • Size 443KB
  • SHA256 082f04668c9da3d8f22cd743b8e96171792b5f5b7397a36c2736a232c8c19c91
  • MD5 101f7f74844d0bee8d058a4931ad69b1
  • SHA1 3b57a073d6002ad572cb8d2f87ac7843c255648c
  • SHA512 c43c7133a6b8cba6516f823ff89f4ac42c50c20b6025cbbb71c59831d5ddcf876fb13328da94589090746d00609e4933d285d562a9f3f2febd206e40097e40a2
  • SSDEEP 12288:lqlI1T7cZd+YqlI1T7cZd+jqlI1T7cZd+p:lqlyT7cZdbqlyT7cZdOqlyT7cZdS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  • Blocklisted process makes network request

  behavioral3behavioral4
• • Target
    Setup/Update_browser_17.64533.js
  • Size 443KB
  • SHA256 88cb776458d03331ab178b903629144b0ddb79a5ca78008e855d6262a5d650b4
  • MD5 d4782d931fd114cc15c57ac871b86183
  • SHA1 967c1e18177b888b8aca32804f63efac7989f8ea
  • SHA512 f819c4bbaeda3fdb0626f126c5fdb33e482f56aabf09fb595bd39986530388230a31af6d78ce796905036c502b0e9525694f5ccd427d20043922de09d8b8e205
  • SSDEEP 12288:lqlI1T7cZd+0qlI1T7cZd+jqlI1T7cZd+p:lqlyT7cZd3qlyT7cZdOqlyT7cZdS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral5behavioral6
• • Target
    Update_browser_17.6436.js
  • Size 296KB
  • SHA256 8346d8f6adf67626c8210a95a4f2723a66014dceff0b3a2ab5ac0b3bc3524f48
  • MD5 3d24103c5024af899e9adea40e7efe67
  • SHA1 36ac265436199e0894f630e4947088f3f5c19340
  • SHA512 79d3551a7573ac97842a498f64d849133e6e15eecd0c9eae3b7723b48523bc370a664959bfa57ee3de8228e33d27601a64a25e80f730c6a03108ae19cab83a75
  • SSDEEP 3072:4OpyDJu8XUtQQSO1T7cbF/nlz3wq2BfOpyDJu8XUtQQSO1T7cbF/nlz3wq2Bp:lcJ6QhO1T7cZd6B2cJ6QhO1T7cZd6Bp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral7behavioral8