Extracted

• • Target

    MV PIONEER IRENE1.js

  • Size

    1.3MB

  • MD5

    9ada0e7d8b3fd0b3b5509e961f8f69cb

  • SHA1

    109f9a3ee9975fb1535b929a259de4c6de8a26a2

  • SHA256

    f293561f8a8432c1f92858eff79fa9cb0dce4292687f09a6ee1ea52cb395961d

  • SHA512

    3ef03e77c5f6b18c820773ae839cb74dbba1c24f5b0409bf304002dcb77360a52bdffafdc65a62a5782d7e4944cfaff75441527648b0d53c393c9a327659fc08

  • SSDEEP

    24576:D6TEbroV1XoNqO52U8efYc/UmTU1TVEcH51NW6:WAIrA52UpTK9G6

  Score

  10^/10

  vjw0rmcollectionspywarestealertrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2