Extracted

Extracted

• • Target

    RFQ2022-284.js

  • Size

    43KB

  • MD5

    fa2a3aa3871df17e3178c6090cb3e759

  • SHA1

    5437b35ae4419dea19dbc82ec4fc72abb805cb43

  • SHA256

    f1cbac28e8fab8c57c6ef688a473f607073ef2e23058faf2154cfc8ecfc889a2

  • SHA512

    a062025594251910f10feabf77ff0b45e4578932d9f978538c84e120a3416c4fe5b986e75b21bfeb37df1d1c97ffb87588bccfcb549358df54694856b76736a7

  • SSDEEP

    768:NYNHavYQXufkGTg1Cp6oLmK0skxnYYToJC6XUFa1sQrEzRxshs:ewASGlmK0skxnci2sQYzRxv

  Score

  10^/10

  agentteslavjw0rmwshratkeyloggerpersistencespywarestealertrojanworm

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2