Extracted

• • Target

    New-Order-Inquiry-07.js

  • Size

    1024KB

  • MD5

    cb32d3299d139de82efbe38c31d379c8

  • SHA1

    5901b1a633df74091f6eab12cd8659b679b6389f

  • SHA256

    88f66b1c3f077e2b2ecfe3f6825a08f58da24a9ce6acce0c13ca162f0823babc

  • SHA512

    916e345cf489b0439c6ce8f8f04b9ab0225ca9ae67164b36063d30cf6a0239ab156a0c2416e7e04caeeef2e9a44268c9eb1c031f98694e4c9747358953bc796a

  • SSDEEP

    1536:cFyQ7B4UqOYR8x1PrZoH3RKeZb1zjjrFAbFTQlHU8E8RzI9woSFtfIu5:cFlFr4l1zjjropQlOivCu5

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2