Overview

overview

10

Static

static

763904f1_U...vXW.js

windows7_x64

10

763904f1_U...vXW.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    763904f1_U2aZzq1vXW

  • Size

    208KB

  • Sample

    210905-fnnbysefc8

  • MD5

    763904f17e55bb5bfa038bed7a3a3ff6

  • SHA1

    0bbbf2007444d743e13ae8666cf55fd2e40fc6ff

  • SHA256

    c8602635235e660c6fb7c8f69ea586482c972a807d7dac0cc81c56fcf0d93e02

  • SHA512

    4c7eee1a479aa9f22271a99419e3cf076203ed035e49ef1b9f02361855213d4b75015f3d5e1d065de5c0cbf71031ffc18afe766ff38246c8dbca56c5a5e4494e

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      763904f1_U2aZzq1vXW

    • Size

      208KB

    • MD5

      763904f17e55bb5bfa038bed7a3a3ff6

    • SHA1

      0bbbf2007444d743e13ae8666cf55fd2e40fc6ff

    • SHA256

      c8602635235e660c6fb7c8f69ea586482c972a807d7dac0cc81c56fcf0d93e02

    • SHA512

      4c7eee1a479aa9f22271a99419e3cf076203ed035e49ef1b9f02361855213d4b75015f3d5e1d065de5c0cbf71031ffc18afe766ff38246c8dbca56c5a5e4494e

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks