Overview

overview

10

Static

static

PO-SS23456.js

windows7_x64

10

PO-SS23456.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO-SS23456.js

  • Size

    99KB

  • Sample

    210920-hzkrbadcc3

  • MD5

    618445370d04d92f4a17f8d9d3c32f90

  • SHA1

    585a522e099853e0213b7eccf96705975c95c8fa

  • SHA256

    dcd947808442eb12dae80b93adf783592ebf62fc1cc095dcd9d856ed9a921f1f

  • SHA512

    8534a0d0777457ff5fe1459c850269f718462a3af91c63fe2b4f174184eecaf66735d2ee085382247e31573d49fa5a909baa8a535cd4ec9d9d6e0391b34a30a1

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      PO-SS23456.js

    • Size

      99KB

    • MD5

      618445370d04d92f4a17f8d9d3c32f90

    • SHA1

      585a522e099853e0213b7eccf96705975c95c8fa

    • SHA256

      dcd947808442eb12dae80b93adf783592ebf62fc1cc095dcd9d856ed9a921f1f

    • SHA512

      8534a0d0777457ff5fe1459c850269f718462a3af91c63fe2b4f174184eecaf66735d2ee085382247e31573d49fa5a909baa8a535cd4ec9d9d6e0391b34a30a1

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks