Extracted

• • Target

    1133543545.js

  • Size

    6KB

  • MD5

    fb50b5a527b81faf53eb766fc69645e2

  • SHA1

    30b12f026d2122f487973235e5d46651a3040996

  • SHA256

    786b63ecc1fb8174eb1301a5498ba858ccac1978cb745afde8c8cd22c7c962af

  • SHA512

    6651176c8cf7815ea48790044873e9b4de1696bba52b2851217b392f5f2ab52bd807f07ac7ce115350520e5e3673be9425ff1fe46afae0ccccb058fd03b01481

  • SSDEEP

    192:CZVh76ew2V2ZIPoH5Xi4FvfkumcR9E+dir8OE3:0V0ooH5Xi4xfkL3pIz3

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2