vjw0rm | 3de222c8faa973c5eeaf92c222b505700c626e80a439c3621a1c0c637babdf57 | Triage

Sharing

General

Target

eReceipt.js
Size

15KB
Sample

211021-a8cs3ahfh7
MD5

34a9c964dd6fb26993c5c5bc7a947a1b
SHA1

f0e16f5620d6be57fe3acd3bc71b2bbd3847c2d3
SHA256

3de222c8faa973c5eeaf92c222b505700c626e80a439c3621a1c0c637babdf57
SHA512

14df72fedcfd19818807bf90bdd5e292fc01bb25d2cc671cd02a8249920b542922be56cc256774f17b85b411955e80fc9294eaf27dfcd36f90743e5e3bfcb1c9

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://loadcash.duckdns.org:7779

http://gameserver-789.duia.ro:6789

Targets

- Target
  
  eReceipt.js
- Size
  
  15KB
- MD5
  
  34a9c964dd6fb26993c5c5bc7a947a1b
- SHA1
  
  f0e16f5620d6be57fe3acd3bc71b2bbd3847c2d3
- SHA256
  
  3de222c8faa973c5eeaf92c222b505700c626e80a439c3621a1c0c637babdf57
- SHA512
  
  14df72fedcfd19818807bf90bdd5e292fc01bb25d2cc671cd02a8249920b542922be56cc256774f17b85b411955e80fc9294eaf27dfcd36f90743e5e3bfcb1c9
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm