Extracted

• • Target

    ShippingLabel.js

  • Size

    2.7MB

  • MD5

    058446c347e32ac73a565e1a799115bd

  • SHA1

    dbbc875ed92a9875ad87165c75cc063a0bb2c440

  • SHA256

    8f9ac4d3cc786019a4a6b3b6c38f4c8c3ebe7a8b9a5b8c88ab156c427ba76648

  • SHA512

    10513b4331bb52c8fe19d6c79037a68e0bee67ec778670ab340be1f8ad3a8f3cf55c6fa4e8d7b771d2feb80ebd359abc09bf8a1baf34b5dfb21ae00c7ecfad87

  • SSDEEP

    24576:XQHhAT5XcpsjFcd5bpqXkwo1jFY7VwyHP3tfrq+lsvfzqaPd9xljl:O

  Score

  10^/10

  vjw0rmwshratpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2