Overview

overview

10

Static

static

DHL Shipment.js

windows7_x64

10

DHL Shipment.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Shipment.js

  • Size

    26KB

  • Sample

    211130-hrhlzsebcl

  • MD5

    454c0a1f986fd08116a76ce313d1d5d9

  • SHA1

    e029654a1552bf57c8f0c89c1592cf69dfc6821e

  • SHA256

    9f58d36fb9401c18f043cd787eeb09db53d73e51154494e0adab8a394b7c3e81

  • SHA512

    d52839205412f7780e94b230e415ea0f96f897a82db9904c11af633ce3e14cab722f0d7a2b9b91ec7db560dceea5bcec3c52ced21bd706c4c4442f24d4c6c4e7

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      DHL Shipment.js

    • Size

      26KB

    • MD5

      454c0a1f986fd08116a76ce313d1d5d9

    • SHA1

      e029654a1552bf57c8f0c89c1592cf69dfc6821e

    • SHA256

      9f58d36fb9401c18f043cd787eeb09db53d73e51154494e0adab8a394b7c3e81

    • SHA512

      d52839205412f7780e94b230e415ea0f96f897a82db9904c11af633ce3e14cab722f0d7a2b9b91ec7db560dceea5bcec3c52ced21bd706c4c4442f24d4c6c4e7

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks