Extracted

Extracted

Extracted

• • Target

    Update_browser_17.6436.js

  • Size

    434KB

  • MD5

    3e2fdaa39431f19d92dc3e4de776593d

  • SHA1

    3255b30e085afa114e2a5b0cf9419d1487059ca8

  • SHA256

    41632e707f7129a25d16c9137bdf4ce4f819a542ed33d8c444f9bd5693ecb975

  • SHA512

    766ebbd8a92d605e04d9ab02ac6c9299bfdbc8eae73c5346510b79e600966d85b3f70a0c8fcbdc52583353e8c4a982c74450a55e9d0992deaa1f2d19cea8baf3

  • SSDEEP

    6144:g+IrEhFgMczj0aw0810VLuqjHFPm4HQQuZ2Ozr:gqkdj8gY4HQJ2O3

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3