Extracted

Extracted

• • Target

    C4HA5CK2MA6.js

  • Size

    82KB

  • MD5

    0619b7e2c22c9c92cb400ec14ca69767

  • SHA1

    e684855f073c754067c9aa165944de464d37a4d8

  • SHA256

    9983e71fb8871f7dab10c52965b7664f380a3a315eed14adebbb0c5db69a2ad5

  • SHA512

    557b75a37b19cb615bf520cac33e5c89a165ac8919994924c6f16d1d883f0c3cecc6e7452a3d56ab39950bb5e863861cf65ae99d2cec9e658e1165ddd7e87498

  Score

  10^/10

  vjw0rmpersistencetrojanwormnanocoreevasionkeyloggerspywarestealersuricata

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Windows security bypass

    evasiontrojan

  • suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL

    suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL

    suricata

  • suricata: ET MALWARE Possible NanoCore C2 60B

    suricata: ET MALWARE Possible NanoCore C2 60B

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2