Extracted

• • Target

    16052024_0935_Reçu de paiement.js

  • Size

    25KB

  • MD5

    d09f2b4326fe1178893ca158e686991a

  • SHA1

    b6e0016a63d51063ecbc40b31a16abb4d8ec3949

  • SHA256

    8389c925d2d78ab7caf0b4747b8301cf98a8f762eff59597f28b8fb6204fc08e

  • SHA512

    c0e0db2c0ed8785114341e9019ef7ae0862ac4fec469a02db951c362ba5186b7f080f98c246d0170578cacdcfb119ae6cd508f996bfd6051bf42179a11528ffa

  • SSDEEP

    384:89/sfhWmJ4QC+/6Kd2Oo9z3+ttBbxjSqnBhtf+MWjfLRrv3bbOdik3Olj85Rknb/:KsfhhJHj66SKPKqnvN+1f1v3XOxJR+MY

  Score

  10^/10

  vjw0rmexecutionpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2