Overview

overview

10

Static

static

Payment proof.js

windows7_x64

10

Payment proof.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment proof.js

  • Size

    201KB

  • Sample

    210824-hpn6jaqqjx

  • MD5

    7371063acbfacc81ffdeaeea7e75eb99

  • SHA1

    28ee63662467f1ab7c682eec227b66db7ccadeca

  • SHA256

    6915f06eb48cc9d71dbc136313c6a935b36844641f9b2ae1e85e08ccc74d8e73

  • SHA512

    8b3bebb2cd6f97a49f98e3072393ea6ad2f46e0f4ba4a25b1293c10b1fe75e192800d6b47c60b03680934517e35d2dc6c4786f0122785675e1cc2e247fa292dd

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      Payment proof.js

    • Size

      201KB

    • MD5

      7371063acbfacc81ffdeaeea7e75eb99

    • SHA1

      28ee63662467f1ab7c682eec227b66db7ccadeca

    • SHA256

      6915f06eb48cc9d71dbc136313c6a935b36844641f9b2ae1e85e08ccc74d8e73

    • SHA512

      8b3bebb2cd6f97a49f98e3072393ea6ad2f46e0f4ba4a25b1293c10b1fe75e192800d6b47c60b03680934517e35d2dc6c4786f0122785675e1cc2e247fa292dd

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks