General
-
Target
HOO8M_Invoice_Copy.js
-
Size
11KB
-
Sample
211018-yft4msfeaq
-
MD5
4bbeabc7d902f9f654cfe9c4f51d155d
-
SHA1
04b90a68e3911bc4edcf355c1db4567ae173c601
-
SHA256
e3f46470aa9ef52628f741e07db33a6af854693ae2a761d397bf87fbfbe687c9
-
SHA512
ecebe6eeb0848600cc8d4ac6b612ad4f02e5bce7d3f35ed14936508aa987c449a8e8029752bfa0b46ed68661836b99692abedce4175d3a7085aa22e0cb9882e5
Static task
static1
Behavioral task
behavioral1
Sample
HOO8M_Invoice_Copy.js
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
HOO8M_Invoice_Copy.js
Resource
win10-en-20211014
Malware Config
Extracted
vjw0rm
http://btime1624.duckdns.org:7923
Targets
-
-
Target
HOO8M_Invoice_Copy.js
-
Size
11KB
-
MD5
4bbeabc7d902f9f654cfe9c4f51d155d
-
SHA1
04b90a68e3911bc4edcf355c1db4567ae173c601
-
SHA256
e3f46470aa9ef52628f741e07db33a6af854693ae2a761d397bf87fbfbe687c9
-
SHA512
ecebe6eeb0848600cc8d4ac6b612ad4f02e5bce7d3f35ed14936508aa987c449a8e8029752bfa0b46ed68661836b99692abedce4175d3a7085aa22e0cb9882e5
Score10/10-
Blocklisted process makes network request
-
Drops startup file
-
Adds Run key to start application
-