vjw0rm | ba43508418c1890886dd6c68e7dc0d0a8291c147c3919147d0ba89b29e427566 | Triage

Sharing

General

Target

2021_11_17_AB2106159.js
Size

272KB
Sample

211206-hj7wxaddgn
MD5

1fa10808ee55f1de160b3628fde35526
SHA1

5422d9396f3b782fc88dfba492a51560a9e98275
SHA256

ba43508418c1890886dd6c68e7dc0d0a8291c147c3919147d0ba89b29e427566
SHA512

ed6e4c317560165f13dfdaf7839a187c38e2e67255753e11f5c3f090a595a44991a2394210439ad9554e3f501ab12621413b44409ea5d348fbaa0533abba565b

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  2021_11_17_AB2106159.js
- Size
  
  272KB
- MD5
  
  1fa10808ee55f1de160b3628fde35526
- SHA1
  
  5422d9396f3b782fc88dfba492a51560a9e98275
- SHA256
  
  ba43508418c1890886dd6c68e7dc0d0a8291c147c3919147d0ba89b29e427566
- SHA512
  
  ed6e4c317560165f13dfdaf7839a187c38e2e67255753e11f5c3f090a595a44991a2394210439ad9554e3f501ab12621413b44409ea5d348fbaa0533abba565b
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm