Extracted

Extracted

• • Target

    Update_(Official Build)_121.0.616.js

  • Size

    2.1MB

  • MD5

    06d126c1c612fff5200d81d27a55146d

  • SHA1

    855c4d47c573c62f73c339a9392fb22265c0a884

  • SHA256

    6369daabaaddeae0814f8ad5a1a931d180a32d7ef9c5738215aead2f6a90849c

  • SHA512

    f29999b32558e4b3689b2439521c0266aba92afa312e4f230b4b7a0932ddfcc0b8141a77d966734bd65dba5f38cb714cf814bf4e42491709a99716b005f6b0d7

  • SSDEEP

    49152:blHeolHeolHeolHeolHeolHeolHeolHeolHeolHeolHeolHeTlHeolHeolHeolHJ:bhhhhhhhhhhhQhhhhhhhhhhhhhhhhhhd

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2