Extracted

• • Target

    Update.js

  • Size

    3.9MB

  • MD5

    a258d4bc0d68fd1bd8eca1a04f204caa

  • SHA1

    a287d8e69d87b0134405a64e4293d08a20fa1973

  • SHA256

    76f6ad7ac251a4529341f28fc1aa4dc0ee2836caccdcf146816dab5040697884

  • SHA512

    6fee6c9ef2cd8151fc8cd79e049041bc9ebe031ee72cd05f150c54fba21f9b93f7692746f6bd18868314c065ecc77d694034ab351ccd171017ab0209f15a473a

  • SSDEEP

    49152:6sz6FvpOiHY7sz6FvpOiHYXsz6FvpOiHY7sz6FvpOiHYEsz6FvpOiHY7sz6FvpOQ:60WQ0Ws0WQ0Wd0WQ0W5

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2