Overview

overview

10

Static

static

NUF7788299...01.vbs

windows7_x64

10

NUF7788299...01.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NUF77882993883JJS01.vbs

  • Size

    15KB

  • Sample

    210826-nvhp7a76y2

  • MD5

    6adbdc4f8416b3002c17f67f6fc68471

  • SHA1

    23b7fbbe29a977a9b6f0b7739daa81901b5c5508

  • SHA256

    8f47c6601f5a5bdaa0a35ae18b93451bbfc674219adb8e896e25085f326dd32f

  • SHA512

    d2caa17b0ff821a1e30d038c33c8c3bfd6aff49061e758697f47b2e063b276f25b8daa4916d4b653fefaa78632a8e6a29f43a42d4e244a795e1945647a5fad17

Score
10/10
vjw0rmtrojanworm

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://sylvaniaindianrestaurant.com.au/wp-includes/FR7501.txt

Targets

    • Target

      NUF77882993883JJS01.vbs

    • Size

      15KB

    • MD5

      6adbdc4f8416b3002c17f67f6fc68471

    • SHA1

      23b7fbbe29a977a9b6f0b7739daa81901b5c5508

    • SHA256

      8f47c6601f5a5bdaa0a35ae18b93451bbfc674219adb8e896e25085f326dd32f

    • SHA512

      d2caa17b0ff821a1e30d038c33c8c3bfd6aff49061e758697f47b2e063b276f25b8daa4916d4b653fefaa78632a8e6a29f43a42d4e244a795e1945647a5fad17

    Score
    10/10
    vjw0rmtrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks