Extracted

• • Target

    Update.js

  • Size

    3.9MB

  • MD5

    01d7daa58e16da2b30ac20fe57081bba

  • SHA1

    8213900420ed4c22b1e896acb53f99a5989cb2cd

  • SHA256

    a05933c299a81badef96fd575ff0f7d934c3edaf0f7478e897a2299f1ef8f11e

  • SHA512

    9a99fbf90fb7274cb0a1300c8052ee419258575b6202df9f78ed0c5dd0d5905cab63a92a96d426261257bead247b125bc05086f622589f3080abd53cddd14f64

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fuVCz4F9dM2furCz4F9dM2fuWCz4F9dM2furCz4F9dME:OkGgkGMkGgkGNkGgkG9

  Score

  10^/10

  netsupportdiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1