Overview

overview

10

Static

static

DHL Septem...etu.js

windows7_x64

10

DHL Septem...etu.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL September Pickup Form for E-Shipment Retu.js

  • Size

    31KB

  • Sample

    210903-dhw1ssfahq

  • MD5

    0bc390a3151f3d4524d81c4f039d2685

  • SHA1

    89d78b77ddbfbeb17d4d1a589d93f886bdc76e80

  • SHA256

    21c1f33b0a6d1b5ecaf03b167e8701a9e9fa4ecf8935e9437ad01cc8f944349c

  • SHA512

    d658ed37178255fbe2b8bca0dfc34a142c11139ddef078abb241a6c3bcb8759a4a46c693c14142bffc53eed1f18f0af394489ba66dcfed25b9aacca78aae76f8

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      DHL September Pickup Form for E-Shipment Retu.js

    • Size

      31KB

    • MD5

      0bc390a3151f3d4524d81c4f039d2685

    • SHA1

      89d78b77ddbfbeb17d4d1a589d93f886bdc76e80

    • SHA256

      21c1f33b0a6d1b5ecaf03b167e8701a9e9fa4ecf8935e9437ad01cc8f944349c

    • SHA512

      d658ed37178255fbe2b8bca0dfc34a142c11139ddef078abb241a6c3bcb8759a4a46c693c14142bffc53eed1f18f0af394489ba66dcfed25b9aacca78aae76f8

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks