vjw0rm | 68921406e9b3c27e573cbf28f5d12a5b46cb40501384feaf13e4e3f753246d2c | Triage

Sharing

General

Target

00SI886_SO_0169256IN_20210818_000.js
Size

31KB
Sample

210830-cd38szk7d2
MD5

786cd57e65ffb85f2e19b3d2ef3dc0bf
SHA1

e36e41a8bb11ec29f90e0b3c643e2707d2a2f255
SHA256

68921406e9b3c27e573cbf28f5d12a5b46cb40501384feaf13e4e3f753246d2c
SHA512

45d85f01d0b2b2f8bb13e886ec8015c0f8d906b9041910ad94c2be2de4557c312f36cf018ccf37bb6fa362b1a6a49da674a08687691e78e78855206cb6cdcb99

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  00SI886_SO_0169256IN_20210818_000.js
- Size
  
  31KB
- MD5
  
  786cd57e65ffb85f2e19b3d2ef3dc0bf
- SHA1
  
  e36e41a8bb11ec29f90e0b3c643e2707d2a2f255
- SHA256
  
  68921406e9b3c27e573cbf28f5d12a5b46cb40501384feaf13e4e3f753246d2c
- SHA512
  
  45d85f01d0b2b2f8bb13e886ec8015c0f8d906b9041910ad94c2be2de4557c312f36cf018ccf37bb6fa362b1a6a49da674a08687691e78e78855206cb6cdcb99
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm