Extracted

• • Target
    NEW-PO.js
  • Size 100KB
  • SHA256 9446c38b335edc7d0dbfa754ad0a8f1a41de185f83722b43816b739c3ceb74f4
  • MD5 485e3fa1027dc300cbcf48fea637dd57
  • SHA1 589ff4d6aae5af14bc251db32ec6e239f63dcdc5
  • SHA512 257b334e96bc4dc1fcd184e5d77f97bec8fffec3f76b4b8038c9f8b148a4e400dcfe2c7907720863cd3dc160ef048db3ef224646db5b27b3b4f98113c067e888
  • MD5 SHA1 SHA512

  Score

  10^/10

  vjw0rmpersistencesuricatatrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

    suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

    suricata

  • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2