Extracted

• • Target

    Update.js

  • Size

    2.6MB

  • MD5

    239e05fd1e101ecc5805aa30df37c9e2

  • SHA1

    6674082d503779d31139fa593b7497f1bcc0eb39

  • SHA256

    59cb06a918fceccc7914c5dde4141352919d7b6a8a10ea248005f040f017d091

  • SHA512

    d89ef87d124543dc36a2cda0bccb0e98ca6edabdf58bac68be8079a1af7e79c7aa9f2c5481036fb11ae2b1bb46c21aed216ecf7d2cc14e2c54b04dfe6d224e6d

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fuTCz4F9dM2furCz4F9dM2fui:OkGgkGwkGgkG9

  Score

  10^/10

  executionnetsupportdiscoverypersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2