Overview

overview

10

Static

static

M00GS81.js

windows7_x64

10

M00GS81.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    M00GS81.js

  • Size

    12KB

  • Sample

    210902-whhghsbbf4

  • MD5

    c13241ded75091693e62997f354ad11a

  • SHA1

    f55d0dc6dc2eceb4ae5dd840a78fa33ec7b49e22

  • SHA256

    8b05f60c51fd14d31431b14b28c384b379dbbafb0788633db77e8aefcafd4e8d

  • SHA512

    d76a0c2de778b432fb357d2b80c28ff6434cb1345bbe9e1589522661ec47b1d2c5f366399efbc0d13978fd5f443578a9e6c1b2f813b16e4e3e68c0e2296e7b54

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      M00GS81.js

    • Size

      12KB

    • MD5

      c13241ded75091693e62997f354ad11a

    • SHA1

      f55d0dc6dc2eceb4ae5dd840a78fa33ec7b49e22

    • SHA256

      8b05f60c51fd14d31431b14b28c384b379dbbafb0788633db77e8aefcafd4e8d

    • SHA512

      d76a0c2de778b432fb357d2b80c28ff6434cb1345bbe9e1589522661ec47b1d2c5f366399efbc0d13978fd5f443578a9e6c1b2f813b16e4e3e68c0e2296e7b54

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks