vjw0rm | ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408 | Triage

Sharing

General

Target

ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408.js
Size

19KB
Sample

210803-64sh8rnc62
MD5

136475f8c1a1c7f23d87ea255926df15
SHA1

a2f0c5d389116df32e96c5e03210c370ea04da09
SHA256

ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408
SHA512

577ea90c902e95dd8ce1bf8227fad2439023d52733c57ccf3d1fe20e21c19b14529f1e23e75ef756b28c0c83d03c1a0a0e09ab5d04208a019647c15a2f5b070e

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408.js
- Size
  
  19KB
- MD5
  
  136475f8c1a1c7f23d87ea255926df15
- SHA1
  
  a2f0c5d389116df32e96c5e03210c370ea04da09
- SHA256
  
  ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408
- SHA512
  
  577ea90c902e95dd8ce1bf8227fad2439023d52733c57ccf3d1fe20e21c19b14529f1e23e75ef756b28c0c83d03c1a0a0e09ab5d04208a019647c15a2f5b070e
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm