Overview

overview

10

Static

static

COTIZACION...079.js

windows7_x64

10

COTIZACION...079.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COTIZACION July 1079.js

  • Size

    16KB

  • Sample

    210729-ztek842nbn

  • MD5

    8a64707b027a9b569641b6151c54ba24

  • SHA1

    b34f4dbb2f5b9a34645ea444db51841d9325a8cf

  • SHA256

    6e64dbcbe7e1c0e0eb8f4f967b936221c7a6c0185718fe991612e478e22f9cc8

  • SHA512

    9cade1e35eca162b7c06529b104db155e7c3a3f62965a88cbc66d709ee17ae7e86f53307b2208829d8c1ed498c96bbc3f73e7935df12b01533b4ef693f900456

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      COTIZACION July 1079.js

    • Size

      16KB

    • MD5

      8a64707b027a9b569641b6151c54ba24

    • SHA1

      b34f4dbb2f5b9a34645ea444db51841d9325a8cf

    • SHA256

      6e64dbcbe7e1c0e0eb8f4f967b936221c7a6c0185718fe991612e478e22f9cc8

    • SHA512

      9cade1e35eca162b7c06529b104db155e7c3a3f62965a88cbc66d709ee17ae7e86f53307b2208829d8c1ed498c96bbc3f73e7935df12b01533b4ef693f900456

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks