Overview

overview

10

Static

static

D61N28A9X6.js

windows7_x64

10

D61N28A9X6.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    D61N28A9X6.js

  • Size

    81KB

  • Sample

    211007-s6hweachan

  • MD5

    9fb6723be237a72c8e0cb6622db940b7

  • SHA1

    497d9d5e827ef3e28e5786faf011cff5592d5545

  • SHA256

    2a1be7d69e5ac0c8e53caf808c1de217c90f2351af6310aa7134f5fa5284db96

  • SHA512

    7d7de7b01157e7d4e1a8cd52605e381fb802e32f2cff00514067c9cfbe28d471b857fbf0fc429e2a0a45b2199482d582640e4538e527bb2afeb1eb753c4929cc

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      D61N28A9X6.js

    • Size

      81KB

    • MD5

      9fb6723be237a72c8e0cb6622db940b7

    • SHA1

      497d9d5e827ef3e28e5786faf011cff5592d5545

    • SHA256

      2a1be7d69e5ac0c8e53caf808c1de217c90f2351af6310aa7134f5fa5284db96

    • SHA512

      7d7de7b01157e7d4e1a8cd52605e381fb802e32f2cff00514067c9cfbe28d471b857fbf0fc429e2a0a45b2199482d582640e4538e527bb2afeb1eb753c4929cc

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks