Extracted

Extracted

• • Target

    Update_123.0.6312.111.js

  • Size

    22.4MB

  • MD5

    c0e810d8e3142bfc0c5cd606e1316f5f

  • SHA1

    61f4b334b4a2a723469a65a3c16361f578b7ef2d

  • SHA256

    c44c75c3724806765edb1de79f9c459980537761769d54dc173540cf7d0775f5

  • SHA512

    3f527308119d90e39ec431366020842873d3d1da3886aadca04d8e8f1509324742766d6b0663af1e2f42f5416d4c2015a89afde18248e6e746e6bcd700267a87

  • SSDEEP

    49152:I7VIzjCxbeqHlp4WhwN0b/hJ9EiItYzYqmZV+86OL3t0/r39GoD53quUQKugpcEa:W

  Score

  10^/10

  executionnetsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2