Extracted

• • Target

    RZKpmwZyCc_movar.js

  • Size

    68KB

  • MD5

    387b3482bc2829229722380c02a7a6f0

  • SHA1

    81869d1b70775e564e583fb955ae8179b183122f

  • SHA256

    c82380d45b2e255e7121f6a76b2e9daf3e03836b8f3121f29aab932377fc8dc5

  • SHA512

    5810c27e2b677c0864198cd03a06100324e85c53f6324429a8a680a935e064dfc141920303a60c732ad3f2bab8e48b11261a5c963e9e362dac19414aa83b299b

  • SSDEEP

    1536:enVk9hSrHAb6G+GCEnwH+acT16uXNWrI5UjelXjk:enq9qHE9+CBT16tB

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2