Overview

overview

8

Static

static

6

JDPSA802320.js

windows7_x64

8

JDPSA802320.js

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JDPSA802320.js

  • Size

    657KB

  • Sample

    210113-xbpz4kl79x

  • MD5

    e87e4ce6983d916ded30c89431b27a2e

  • SHA1

    8e60077e3d47bf1ca61051c7b31a34a621b93ec3

  • SHA256

    e75c65acc78374f43ab387d8eb1064a550111c5a22bf75d16af7cfe117191796

  • SHA512

    810b682c61d6979283cd867379ecb478ade89efce4c8e57d883c46241edd3a97863ab24782e32f02b736b3c05a2bd9933b3796a90b02591f5cce141abf502295

Score
8/10
persistence

Malware Config

Targets

    • Target

      JDPSA802320.js

    • Size

      657KB

    • MD5

      e87e4ce6983d916ded30c89431b27a2e

    • SHA1

      8e60077e3d47bf1ca61051c7b31a34a621b93ec3

    • SHA256

      e75c65acc78374f43ab387d8eb1064a550111c5a22bf75d16af7cfe117191796

    • SHA512

      810b682c61d6979283cd867379ecb478ade89efce4c8e57d883c46241edd3a97863ab24782e32f02b736b3c05a2bd9933b3796a90b02591f5cce141abf502295

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks