Extracted

• • Target

    PO_CG20210302346.js

  • Size

    742KB

  • MD5

    4d7d2a0d4fe470f6cf2a0a9fc519a5ff

  • SHA1

    c8364f810e6c2bef6801c4b7196882dca05decb0

  • SHA256

    7d024e7fbc39d9379d96332276f41b08670843de3803ea91b257efeadbf8f46c

  • SHA512

    fb3c7bb3fdec6257a8c027e54662f4ac9eb9952647201f10a5942011810d9690bf6b970718bc38038093df9f1d8ab349b3b27cf6432ce69df1e383a7074977f5

  Score

  10^/10

  vjw0rmpersistencetrojanwormxloaderpzi0loaderratsuricata

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2