Extracted

• • Target

    c-users-bcrabtree-downloads-update-js.txt

  • Size

    5.2MB

  • MD5

    9967ea6d3719ab8cc181766ba7098b3b

  • SHA1

    f26c05f206a6d06761f46abd40ae1aa381861d73

  • SHA256

    aaad6ee087c6942dad2e084453cafe83cd6ec26f62dbe43b1254345828f7cbac

  • SHA512

    d64b3d3a45c2dee4fd712444903992757772187ead4a0f23d5856270c18c0c80eb7626404b1104a41cae42decd5be16c137b41608c335e994fe1a40ed6eb8f59

  • SSDEEP

    49152:6sz6FvpOiHY7sz6FvpOiHYXsz6FvpOiHY7sz6FvpOiHYIsz6FvpOiHY7sz6FvpO8:60WQ0Ws0WQ0Wz0WQ0Ws0WQ0W5

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2