Extracted

• • Target

    payment receipt.js

  • Size

    51KB

  • MD5

    7bdc2ed878e95f7b8b20656f2758d252

  • SHA1

    fabccf889c3621122cedb7187992f107a9ebf4e3

  • SHA256

    5619ede0802eae9659da207f84f3bb00d576bc80601609557f0cce017dc35501

  • SHA512

    9c70289013d254a60baf0dd9b262c1e9fe0bb83afc2eb964d861ea46433efff80485c924cb4fe9df5695a9ef8a9cf214ef0bb3042730346935c517c21c7f7874

  • SSDEEP

    1536:Vvg6+0G1wGoaf9QgNEtAv621X+2w9nX/f2YfpK:Vdxci21Xy4

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2