Extracted

• • Target

    06aa113b75c9ddc108ff63d9037edade50e289f1130418a952f785653ef5255f.js

  • Size

    55KB

  • MD5

    cd2d5a502d440723de4924354e1b8641

  • SHA1

    de0648c4f80577e5721e21c840790f1e9aec797c

  • SHA256

    06aa113b75c9ddc108ff63d9037edade50e289f1130418a952f785653ef5255f

  • SHA512

    728fcb366be08fde12b91f77667871b9770ebb5fb0450611f401c852d7bfbe9fa5e3a3a57c7c756e5d375033c49be84ca42fc2e6dd4d624acf230515ecf5db71

  • SSDEEP

    768:kbVlwQU89qOfShvRI8r3mRDCrn+KC6PvLczmfl5tO7OKXycUU8OiS6:CVxU85S/I8rWen+K7L7fU7licUU8Ou

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1