Extracted

• • Target

    ChromeUpdate_130.0.6723.js

  • Size

    79KB

  • MD5

    4b0f51e544587d445b555d456fb4b4a3

  • SHA1

    3485771d900dc9966bf3af61eb4dcc8ccbba8c3f

  • SHA256

    9d81f9c0cc790f6516f7866f897d41a61bcc8a4d609f64db71c7978c144d89e9

  • SHA512

    12ab55347c3d8b258e1dfb555f98c2eb83daf81e1e9ec214b0ed540c76f60a37681269ce304dd527d7cbbda3c1ed387c7159a69c744c149cdfdab77efd78666e

  • SSDEEP

    768:wOeOeOOO4NJNI+cXecXIYxda6GbcX2oj/xvDcX2mlooVslo4LTcXGUcXK:Hj/o

  Score

  10^/10

  netsupportdefense_evasiondiscoveryexecutionpersistencerat

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1