Overview

overview

10

Static

static

PG4636.js

windows7_x64

10

PG4636.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PG4636.js

  • Size

    25KB

  • Sample

    211130-xam8gafhen

  • MD5

    3a55168bae35da0ff8a02ca13b65feec

  • SHA1

    dcf7b48bfb2a994598d0f0a45c24121a4ee22255

  • SHA256

    e114d03550228080f08b8053424ad98b31e285b64b5dc4d1476b93cc5a6ccfe3

  • SHA512

    1cb2db2a7beedcb84ade4fb6d91f5408932d4acfb94ae08fac98c7571e544af6b57475469f7f49cf4348bd8852df2bd8e5fc9b931bfa18ac38e2d447a1411b74

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://spdxx.ddns.net:5050

Targets

    • Target

      PG4636.js

    • Size

      25KB

    • MD5

      3a55168bae35da0ff8a02ca13b65feec

    • SHA1

      dcf7b48bfb2a994598d0f0a45c24121a4ee22255

    • SHA256

      e114d03550228080f08b8053424ad98b31e285b64b5dc4d1476b93cc5a6ccfe3

    • SHA512

      1cb2db2a7beedcb84ade4fb6d91f5408932d4acfb94ae08fac98c7571e544af6b57475469f7f49cf4348bd8852df2bd8e5fc9b931bfa18ac38e2d447a1411b74

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks