Extracted

Extracted

• • Target

    Update_123.0.6312.111.js

  • Size

    6.4MB

  • MD5

    7ba92986c21efee4f71b32fa2c7432a9

  • SHA1

    43c73ea04905bafd0054259bb6d1f2a536f9ed9c

  • SHA256

    8c1ff294e95c6f03b3f8e9d4cd372ef3c9925c88e05a26947e06411ff0f3d9c1

  • SHA512

    622014892922365c82b5b6a8ce65063322ef45dc24ca759964e8c704dfbbea314ecbf5e3ef5ffa10d2fe3c2788958684eaca1038e14fa59ff379c65f5154d9f8

  • SSDEEP

    49152:s7VIzjCxbeqHlp4WhwN0b/hJ9EiItYzYqmZV+86OL3t0/r39GoD53quUQKugpcEs:c

  Score

  10^/10

  executionnetsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2