Extracted

• • Target

    $RECYCLE.BIN/$I4FIL8H.js

  • Size

    544B

  • MD5

    3bb5ddbbc15c65e6d7af1c41a877bf2f

  • SHA1

    c9411803abd57b1c62936f7a973fde45b792a0f9

  • SHA256

    73cfb6a30179d5759f151505756edd832bdfe6675424cdfef2d0d95b9265fe14

  • SHA512

    6b3eacbd3de4c5ec44852cef7349062d206f3af35f6f315a9e57af6023ac3cd563bd4bfc3f1ce4a1ca69e394e2fd33bec7a7185bac289be7ac713bc24a497686

  Score

  1^/10
  behavioral1behavioral2

• • Target

    $RECYCLE.BIN/$I5VEPRW.js

  • Size

    544B

  • MD5

    7fcacbf214c7091a4e52f42ba83ca75a

  • SHA1

    93e6071f014cd5f47dbc0e52c93aadcde29e1457

  • SHA256

    1704bea192c12c3d81474e73f5d0a2cc98cb57e9440e3f033862bd85f5980f85

  • SHA512

    bae645c2ac3758975d468413e430c22c8c9803d90b65ea2d593ab542f901ad771bec89a6eef87103b28105a38addfa97cabb794f488caeb6024542d5c5a8f27f

  Score

  1^/10
  behavioral3behavioral4

• • Target

    $RECYCLE.BIN/$IMH8R2U.js

  • Size

    544B

  • MD5

    2c4439dfc4bfb10e8bf9eb4c2932e067

  • SHA1

    925eba054aae34b564c9f70f6813b70eedc744f8

  • SHA256

    161b64c65461b1aa5fbbdfb7d465686ba02b4b3d89a19aaafb2f1a0f4f72597a

  • SHA512

    64f02a63b754586e03a27547f4a2c468307318768bfb24bbb7ad3e02fc726c9e057e1770e8f84b849aad93f9751a655082129bde03a1c45afb6edf495f588501

  Score

  1^/10
  behavioral5behavioral6

• • Target

    $RECYCLE.BIN/$R4FIL8H.js

  • Size

    9.0MB

  • MD5

    5d97ab7f843e6c18b96c4e34bd65ff09

  • SHA1

    9ad9f18b92f57a3e1536a552dc3e4081b34169e2

  • SHA256

    eb841738aeb5f98695da31d3ebe1bf241f8411283373fd6e99788fc52903b1be

  • SHA512

    116897043738962c9e059d4701e01b3f36987100a00951ef020c2481dc100a3a59eaf106e5c96b042019dceb53b3a143454c6aaa861262bf2d24c45651699e81

  • SSDEEP

    96:kZH1uyAXIXGou2lcJc9l2JEuft2v2wz2zadZxOBeFcr3vVkcZBIKkcZBe4KcZUCS:kZVhpngJpG2wz2xkFm3vVEKZpFEm

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral7behavioral8

• • Target

    $RECYCLE.BIN/$R5VEPRW.js

  • Size

    97KB

  • MD5

    7afbb2051c1ba1c1e88c499c5e11636a

  • SHA1

    4b2a14b3ca310b1f39959c130ae7b72a03078873

  • SHA256

    74fc83dc153086db0329b982e73e8bee4b652d1265c8185b0b4374898a112d06

  • SHA512

    c506d2d13383948d9acfafdc152f81326fc73381530fbb019794f9bc2b7733b3b455f6eddc92d597614f0f6d641f391d737f93f809486707cb1d8f84378309ec

  • SSDEEP

    384:chWWz5Kfy24jHueR45qWWxWBWHKSqmqR4G:XYG

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral10behavioral9

• • Target

    $RECYCLE.BIN/$RMH8R2U.js

  • Size

    97KB

  • MD5

    7aab68aeb388528f9e3448ea0dce56d7

  • SHA1

    07d648c7247e2db064b7ba1b1b21722c475e3396

  • SHA256

    610eb77c6ef6c0767a1b8d0157b39ea5105697ffdf31d2afa5963e4da8cd0cb8

  • SHA512

    1f59fd8a717ff3bf9f57452440a6e08907cd9c32050aa399ab0a591c6109486410e74d21d5ee41355b4b041f4dd88c679d8077b611cfaea9c597aaa67ed0e8b4

  • SSDEEP

    384:chWz5Kfy24jHueR45qWWxWBWHKSqmqR4G:OYG

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral11behavioral12

• • Target

    32_94_payment_bv_xls.js

  • Size

    300.0MB

  • MD5

    62cc1b7497b1c6483cdee99cf94aaaea

  • SHA1

    60c51b7d03bc0b5215fe3cbd9f52cfb89bcf8d74

  • SHA256

    fd38f9a079dd0bd1808baa9c7dcade49a11eda5cade2bf4197bd1aa00d8fe6aa

  • SHA512

    f43113d41e7c0043e26e8f94e9395db2fe531d87104151db8719736432d2466412ae0402cff9f892795e455faef83cbe80bca59a72abfcbfe31061bed3d96df7

  • SSDEEP

    768:L6Nrj4rmY+ABYSZy1YrmyBFcuYyYxy1Y0RrFrX:L6

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral13behavioral14