Extracted

• • Target

    new.js

  • Size

    310.0MB

  • MD5

    d257dbc86304eb58f463718dc39be087

  • SHA1

    8807ea53d0a6e14fdbdad7a44ddf612ccf83c22b

  • SHA256

    765c3ac3b8df6ceab3741f5e97d0aae95631f31a4cce08d583becd2b9578612b

  • SHA512

    d186fff74e2a797184cf084723fde7b898c5ffd70d1edafca96fb8968acc951c7595bf5df691a650736fd01de603940238b8b23c25943fb7078ad96999b17623

  • SSDEEP

    192:/NLJu3352Rl7e5tXqyn41MEgrUTpQKUBRJkeMuSSVs1:1ASl7e/Fn4GEgspChMuSoU

  Score

  10^/10

  vjw0rmexecutionpersistencetrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2