vjw0rm | 2439efeb595232fe819b8827e94d34363727f37f04b466ffccc31053b60f3061 | Triage

Sharing

General

Target

DOCSHIPPING107865489.js
Size

295KB
Sample

211209-l5m1eacgem
MD5

eebde117fa1644f9b176dd62ef22cd12
SHA1

4b8beaafadbea30379442a2610125e685f1c580d
SHA256

2439efeb595232fe819b8827e94d34363727f37f04b466ffccc31053b60f3061
SHA512

974a2c6e5556c42574e47569042103c67604dc6cf911f6af8c2624156017ba845d836909b59c2736f07fb476418b104abc9a2e86b83f344a1ae0213134f4bceb

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  DOCSHIPPING107865489.js
- Size
  
  295KB
- MD5
  
  eebde117fa1644f9b176dd62ef22cd12
- SHA1
  
  4b8beaafadbea30379442a2610125e685f1c580d
- SHA256
  
  2439efeb595232fe819b8827e94d34363727f37f04b466ffccc31053b60f3061
- SHA512
  
  974a2c6e5556c42574e47569042103c67604dc6cf911f6af8c2624156017ba845d836909b59c2736f07fb476418b104abc9a2e86b83f344a1ae0213134f4bceb
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm