Extracted

• • Target

    updates.js

  • Size

    7.3MB

  • MD5

    a05000c90cff2539713a0c3036ddde7d

  • SHA1

    906117ba8d23127d1f60c2bbb50415038e0933d1

  • SHA256

    10585bbc8a42ce31feda61126cd245ec22d98870fde6c2742d44ef08eaa11b67

  • SHA512

    554662f8fe351e9dc8f9e7cbf4fd072d4cbcd2e7ca31699c959bfc3106630acb52d1e14e368ba75182ae150db72422aba7052cad3b3e5a64120ae02bd2e80542

  • SSDEEP

    49152:e7h4zjCxb7qHlp4XONN0G7h20kQmwYzYMm7u+8wgJ3wr/xN1GIWx3qpWROg2cE0M:p

  Score

  10^/10

  executionnetsupportpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2