Extracted

• • Target
    9f40a90db5c7da1cc2ced7e23df53ec3.com.exe
  • Size 1.4MB
  • SHA256 2e37d7372a97df9e3955837eeae856489541aab815dffabc00bbc72af6483e9b
  • MD5 6c6d3758452aa4500bd4186d02a54bbd
  • SHA1 29a36ac35cdd13203b584e4f1176802a8bd999ef
  • SHA512 f6a1332f36948f2d2f593878a704f8d9de8dcb157c3727bdf21203ddf69512f4498faa1a34a86a2e91d5a4b8fc635fd058636a7b38c1cb2e1841efa44c4a18f2
  • SSDEEP 24576:0AOcZ2i7sBG5TH4AI8saogP5+OE8YqZWyqTr+Mo5pemHI0Yuyqgm:iQYAIoh+OE8Yq+xo5EmHWqZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2