Extracted

• • Target

    1ZWAJSAR001.js

  • Size

    300.0MB

  • MD5

    16f64a9f1e8298c60d410e649d4f9af6

  • SHA1

    4ecbd826dd26c8cb1c83e90b260fabc01fb292b3

  • SHA256

    07832ced9085948c808f5d084569f19e7ac6d7ac033d9fe307557b2d62276c43

  • SHA512

    99bf973c22c46827ab153f13365cdffeb47a15f300693f5cbf3faaff71a7043e5a7a1c083c2ce2b02cfb085ba3bd77c8c43f6d0fbbfb9cab74e990318f8cde2b

  • SSDEEP

    192:KERPOQ5/EwSCSgCoR57ATri9xKrw/SDLaMTiye22k8T4Z1FOJ0ow4:KsOA/EwO4lT9xKrw6DLaM5iTTXaE

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2