Extracted

• • Target

    update(2).js

  • Size

    3.9MB

  • MD5

    58d1c8e29c62d629db10478ee481dfe0

  • SHA1

    f41a1876b230318a9850f503b47ce55577ecfaba

  • SHA256

    89e76abe508c70fbf56255671bf613143635292476d9964d82d62fe0696cba41

  • SHA512

    7f1d48e902a4a3f39f4c63fe82b3632e7edf70b24c1fc23226624b9b2cdebf71866ccfa6900f309bc7584234462d16855aba6695d07355a3688f76db9081c5a6

  • SSDEEP

    49152:6sz6FvpOiHY7sz6FvpOiHYXsz6FvpOiHY7sz6FvpOiHY8sz6FvpOiHY7sz6FvpOQ:60WQ0Ws0WQ0WR0WQ0W5

  Score

  10^/10

  netsupportdiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1