Overview

overview

10

Static

static

C0083_Invoice_Copy.js

windows7_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    C0083_Invoice_Copy.iso
  • Size 74KB
  • Sample211012-wpbybachc5
  • SHA256 1ac5463d860af063a8653ef3bc02c6a0a28d089ded5d759530ebe54e8c1da498
  • MD5 SHA1 SHA512
Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

  • vjw0rm

C2

  • http://mchristopherr83.duckdns.org:7922

Targets

    • Target
      C0083_Invoice_Copy.js
    • Size 12KB
    • SHA256 9af04e365ed1f2e0ea04dc71729f0e3341f0f981405c9f3ddd6d6d7b693fb733
    • MD5 SHA1 SHA512
    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks