Overview

overview

10

Static

static

Purchase O... Te.js

windows7_x64

10

Purchase O... Te.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Orderp31010202004011431 & General Te.js

  • Size

    205KB

  • Sample

    210906-1z3k8sbeb2

  • MD5

    84f45bc4a251657855cb82cccf1db237

  • SHA1

    b1a2fe4cd2594f69c3051aac66d19b80352c7307

  • SHA256

    9997abf0f4a9633279822067079293dc8abe470435878191089738e733312d5a

  • SHA512

    433d92f84b6b9b63712286b4e39a1201a4c19cb187ded7615fc16dc343ac2867160e82cc1c03beed9208810aea317c72e8a94e6ed2f6ee80143980b172b5144b

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      Purchase Orderp31010202004011431 & General Te.js

    • Size

      205KB

    • MD5

      84f45bc4a251657855cb82cccf1db237

    • SHA1

      b1a2fe4cd2594f69c3051aac66d19b80352c7307

    • SHA256

      9997abf0f4a9633279822067079293dc8abe470435878191089738e733312d5a

    • SHA512

      433d92f84b6b9b63712286b4e39a1201a4c19cb187ded7615fc16dc343ac2867160e82cc1c03beed9208810aea317c72e8a94e6ed2f6ee80143980b172b5144b

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks