Extracted

• • Target

    Update.js

  • Size

    2.6MB

  • MD5

    44b73d7c14986000a0865aefb01bf02b

  • SHA1

    0f41ec94c405aa3e46b090a3ecda574cb01f17b3

  • SHA256

    82a6ea1721bb31929e77725f9bb6e4dc38719ce8d61a5633285aed7cd5260b40

  • SHA512

    710002980e208a5c061f543c1d36cc529ed8a1e3d6a2bfa39755a6c6fb4e883fd56ac6244715707619845098414e6d0007ee64965ff193aa93a1b57ea93247d4

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fu9Cz4F9dM2furCz4F9dM2fui:OkGgkGmkGgkG9

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2