Extracted

• • Target

    Order 2021-600918.js

  • Size

    311KB

  • MD5

    f875ce20d9473d5dd74d2e0382fb32ba

  • SHA1

    a9b75554d7cb9eae3f06c2b9f3b7cf60617b32d8

  • SHA256

    b71e66c2f3dd88356df6c1bb0cab806156e91bed324c376b45cae58ce051ceff

  • SHA512

    1eccb095f0bd41fb28879a726d8257b3a30cc487efa33fe24f2be2899596ee99bc54179d7003493aec50e55f6e6beac77616a9a8d9c3d80e4cb4a0244c33c4fe

  • SSDEEP

    6144:X/Rfo2A0XbJtYp+JPNqRvhQoACsix01v8sPgMBZe9c/slHWiqIWvfQwc:mkFtYwPNqRGrCG9rYML/FjvI

  Score

  10^/10

  vjw0rmxloaderwqosdiscoveryexecutionloaderpersistencerattrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Vjw0rm family

    vjw0rm

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2