Overview

overview

10

Static

static

#RS00HNAWZ1.js

windows7_x64

10

#RS00HNAWZ1.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    #RS00HNAWZ1.iso

  • Size

    68KB

  • Sample

    210927-gyk51sfgeq

  • MD5

    84a0b17fb49483b8b0fa79066d87afd1

  • SHA1

    991e37038c3d8b604f502f495bb6a939a110c971

  • SHA256

    2507f3526d4419945b1091542eeca79de74602e5cea24b14492fe14be66d7ab5

  • SHA512

    3dd7fc62485dcdc9db375293ce4f75d146ab17823aacd6723696f504c9df7cb9cec3d7d0814d0edefaa64705298221c008175c696280ade2cdc48ed0a00c8e2c

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      #RS00HNAWZ1.js

    • Size

      6KB

    • MD5

      63166917fe9a799888f57c5d5e687170

    • SHA1

      00ac624acb5674ccd82c15370b1295c270d4e1ec

    • SHA256

      c6dd7fd1f49c9bfdba8c03b92d856a086c4ba218a204daa35ebaee0a91ab6a9d

    • SHA512

      6cdabe9785bcc8efe34468a1260454f096589c400f743809df9da450a77f3bd96a10cca0021f1b04b8150855e0e1f9a639b31e8ace41d66e26c23d2e7e68cc84

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks