Extracted

• • Target
    f875ce20d9473d5dd74d2e0382fb32ba
  • Size 311KB
  • SHA256 b71e66c2f3dd88356df6c1bb0cab806156e91bed324c376b45cae58ce051ceff
  • MD5 f875ce20d9473d5dd74d2e0382fb32ba
  • SHA1 a9b75554d7cb9eae3f06c2b9f3b7cf60617b32d8
  • SHA512 1eccb095f0bd41fb28879a726d8257b3a30cc487efa33fe24f2be2899596ee99bc54179d7003493aec50e55f6e6beac77616a9a8d9c3d80e4cb4a0244c33c4fe
  • SSDEEP 6144:X/Rfo2A0XbJtYp+JPNqRvhQoACsix01v8sPgMBZe9c/slHWiqIWvfQwc:mkFtYwPNqRGrCG9rYML/FjvI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vjw0rmxloaderwqosloaderpersistencerattrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2