Extracted

Extracted

• • Target

    rq6cPaymentreceipt.js

  • Size

    81KB

  • MD5

    989740b7f7dab7211c4005e833f37954

  • SHA1

    a814fbaf107d44cbf8ae69a766cb5e7e90a08e4e

  • SHA256

    85bd3b83fb8e9310068cc155999c11d8ee2a71e88f757d59927a3564a97699e6

  • SHA512

    3831d2bf05c928ad2feb83b41ab7544eb62424ca05961698c1b7a349747aab39b75f745e303937af4fad38c437c31813bc471d9cc3ae2f016bc6c1036b6a801d

  Score

  10^/10

  nanocorevjw0rmevasionkeyloggerpersistencespywarestealertrojanworm

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Windows security bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2