Extracted

• • Target

    eVoucher#008891.js

  • Size

    10KB

  • MD5

    f158edaa4f393576c18586889c2ab62b

  • SHA1

    3badef58318a1d1b57560652f26b7afa3581a9ea

  • SHA256

    c2a62e3a170efa1a16b18c7c173c4ddda4f5e13e0f6856d1f4226b297cd27c6f

  • SHA512

    e23caabe20d5599ab387f7353bad365860cf777c422e8e2ad9d185138af956b5ef37c7376e800df01ce9920b1fa3c8d06507a471fabc7b64b49a9d524d4d7411

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2