Extracted

• • Target

    f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e

  • Size

    864KB

  • MD5

    fe330e62ee592637466d5def2358afa8

  • SHA1

    62bb2ec1f62e38b9c2605ba661b85ac10cddefe0

  • SHA256

    f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e

  • SHA512

    ba59ac6e0070aae34b5cc98b6ba041f21fbbb52cd2e4551bc30a0570aa48175abb2c2aef14886bfc54128d080558e5dfd20f8800f572d7286dfa242c7032a9d2

  • SSDEEP

    6144:Wz3WauGXbuv9ShKeCasIsqo13lmV1+4McaFkJK0zaG5GRJ3t8:Xa7Luv9ShbCaB9o3mvX3aFcae

  Score

  10^/10

  vjw0rmxloaderqatvdiscoveryexecutionloaderpersistencerattrojanworm

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Vjw0rm family

    vjw0rm

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2