Extracted

• • Target

    New PO.js

  • Size

    31KB

  • MD5

    352cf3718d548927e00df0c2f4e95014

  • SHA1

    322b413140bb0d6f84caff5c0c990fa4e9f51b1c

  • SHA256

    93d2b208e2606aedbd121f8decf421d3db2606b2ca4f34f9e47a7df89472867a

  • SHA512

    d08679eebe7f647177909024618f558d45c189a58b1ecff364cafde6a6ec65a6fb65994bcbb79ddbd46b1e14fe7b0583cf5ded6d1780c33d55762cf4650f8ed5

  • SSDEEP

    768:18tmrPR6U0hUIttUQiquJhLIiBtm8vzxC7K:1TFqtUQibaexC7K

  Score

  10^/10

  vjw0rmtrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2