Extracted

• • Target

    Quotation Request.js

  • Size

    42KB

  • MD5

    c345961a64e6bf1dd83dea9418c2323a

  • SHA1

    b2edb5c1c41415a1b1f50a809c1b528008bdcf38

  • SHA256

    ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

  • SHA512

    9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

  • SSDEEP

    768:NYN31nEZlOxsDSBppfF3GVk4v4ccO/fD3lzo1r8IYOz27s:e0IdBDtGVmEflMoIYOiQ

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2