Extracted

• • Target

    DOC290823-29082023144405.js

  • Size

    27KB

  • MD5

    ca14b59192253392826fc0112c58b5a3

  • SHA1

    3062aa9e1ce73041e15e923b1434bf48b720090a

  • SHA256

    60dc0a8be19240f01faaccb73e6ca2a36eecbacc4dec970da118a5a5a4c0806c

  • SHA512

    15af45eb520ed208fcd16c4e08272d48c52284fc9bf45524f29c1f2686e9649ee4c9ab5492da5240f397fcec9c81edc7c7c62ad668bff0fa938aa45d9cfca4ff

  • SSDEEP

    768:XR51sMQicU8KzTypDxM9GzRdxVvemUZZbthohf9AQ:B51XcUTAtldxBxUzth89AQ

  Score

  10^/10

  vjw0rmpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2