Extracted

• • Target

    Update_123.0.6312.108.js

  • Size

    12.8MB

  • MD5

    9028294ccd1598b6bddd2f475ecafb0e

  • SHA1

    053de8be8b271a0ee0047dedb4089279a779d057

  • SHA256

    fcb4c12fd365be833e010ff65b681072ed69ee12a105df53c0773ecffdb6f35f

  • SHA512

    136f992fa3ee3295eb6c76a8cf329549718110a973b8451dfd3934f5fe063eca876233cd0c64c36cd30bf8b79f7b9848c509a387be039e677e64756be4efdbf6

  • SSDEEP

    49152:N7VazjCxbeqHlp4EhAN0tLhdJQ+yBYzYYmZF+8Oin35Q/TdxGoZJ3qu4QK+gdcEa:h

  Score

  10^/10

  netsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2