Overview

overview

10

Static

static

H6X8V4C3C02M.PDF..js

windows7_x64

10

H6X8V4C3C02M.PDF..js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    H6X8V4C3C02M.PDF..js

  • Size

    81KB

  • Sample

    211013-xdzqnsehbj

  • MD5

    0448be9d3f5813d311fcdd8bb5d190ca

  • SHA1

    1390e1726b9826b8c49a3f9519e7c04264f7c199

  • SHA256

    c560351620b68f01085c6b449e5256c617ea7eed70451f6c08900c694c08b92e

  • SHA512

    b6efdcb0198e3ae004516d2642acf39dd8f25ac80b8f36b14bd2b32306743ff1b9cefa7680d3b5b78f81a911be42942b27950eaddba45a3366f8bce2509769b6

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://7700js.duckdns.org:7700

Targets

    • Target

      H6X8V4C3C02M.PDF..js

    • Size

      81KB

    • MD5

      0448be9d3f5813d311fcdd8bb5d190ca

    • SHA1

      1390e1726b9826b8c49a3f9519e7c04264f7c199

    • SHA256

      c560351620b68f01085c6b449e5256c617ea7eed70451f6c08900c694c08b92e

    • SHA512

      b6efdcb0198e3ae004516d2642acf39dd8f25ac80b8f36b14bd2b32306743ff1b9cefa7680d3b5b78f81a911be42942b27950eaddba45a3366f8bce2509769b6

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks