Extracted

• • Target

    Update 124.0.6367.158.js

  • Size

    22.7MB

  • MD5

    fcfee72585f617db2f7e7c8dbb17ea87

  • SHA1

    6b2021195a6f6a90b137c67dcafec262c478b4bf

  • SHA256

    b12c6d411ff605497092f9d712f16a0e1948caeca5ca37587f22dce756a2f2b7

  • SHA512

    0cfc4f400ea2651b0fe11218e282b13b4d74eeb1419f25a3eda0da2002a644f0adf4eaf12631b462ddab3c471e9062afe7fbf15b361377d53c66de7d9bab9e4e

  • SSDEEP

    49152:paZYOjByI+BJ8V6tlBDBFvLBLtmpf+T2vPHr+Z3jb4WsjcqTbsPF5xhyMa81qId9:7

  Score

  10^/10

  netsupportexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1