Extracted

• • Target

    Update.js

  • Size

    2.6MB

  • MD5

    36ee5581812c837d817cfc14100ec6cf

  • SHA1

    4cbc8e964776041f36f64a617aa72b445b298e28

  • SHA256

    089f1c779eacb215387da1885406f7b67f2fc0043b9c703f1dccddd3a787f4c8

  • SHA512

    95edeeffd980262016ed47491009326629b8a11c1108dbf9a50ff9dd91d58f1c2d5a358452537265943db98b121c35680d556b653cb01730d8d7545a7f513a89

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fuQCz4F9dM2furCz4F9dM2fui:OkGgkGDkGgkG9

  Score

  10^/10

  netsupportdiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1