Overview

overview

10

Static

static

RevisedInvoice.js

windows7_x64

1

RevisedInvoice.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RevisedInvoice.js

  • Size

    31KB

  • Sample

    210902-brp24kjp12

  • MD5

    ede4c686609d86a917d4db9087bcee77

  • SHA1

    a89d800a5b70e2660484ff875b198082ef307147

  • SHA256

    2d265907c009ffc0c17b656f7dd30e3c585dcbdb0b64553cf0b799cb85855b3f

  • SHA512

    e67562c9581c779fc2dabcc2571b9ae3923009d33174826458d5d986bf33b4d0fc7f9125255c519b97461d8105c1e38ee36656eac5aa2c404e3c9a2dd41bc365

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      RevisedInvoice.js

    • Size

      31KB

    • MD5

      ede4c686609d86a917d4db9087bcee77

    • SHA1

      a89d800a5b70e2660484ff875b198082ef307147

    • SHA256

      2d265907c009ffc0c17b656f7dd30e3c585dcbdb0b64553cf0b799cb85855b3f

    • SHA512

      e67562c9581c779fc2dabcc2571b9ae3923009d33174826458d5d986bf33b4d0fc7f9125255c519b97461d8105c1e38ee36656eac5aa2c404e3c9a2dd41bc365

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks