Extracted

• • Target

    Update.js

  • Size

    6.7MB

  • MD5

    ca8853d69abc5af704d4a71d2da11f83

  • SHA1

    7c5179a432de485c26a660dd025a3b20ef0d7345

  • SHA256

    67f7d43359b5087579c9eb9b1c8201c8168f56c8dfb00b2f0f8c4960b3ebb683

  • SHA512

    c5df1d8c8b23910cff388da28667526d16855c4459e91b860a0000d931c3fb1506d2ec75ae49a53f21a3bf3eec323e7d1d319c323444406650786e6ad43b3de4

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fuVCz4F9dM2furCz4F9dM2fuJCz4F9dM2furCz4F9dMf:OkGgkGMkGgkGSkGgkGcR

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2