Extracted

• • Target

    Dhl Authorisation 0471.js

  • Size

    2.7MB

  • MD5

    eed1ebe93897be063de0e58e4727e202

  • SHA1

    81d8a907c8b0c7aea595f19214588d14f8d34922

  • SHA256

    ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100

  • SHA512

    be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19

  • SSDEEP

    24576:nqCxdnXs0pApmfJL/SoAWQLE6/WXpVxzrO/J/HWVZBmqdYnV0tme/4lFOi51o39D:B

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2