Overview

overview

10

Static

static

#007704.js

windows7_x64

10

#007704.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    #007704.js

  • Size

    56KB

  • Sample

    211216-j8fpdsbeb7

  • MD5

    68dd5417687b71ef0bdee8c19baf4dcf

  • SHA1

    11c068485541aeaaa5d04af692971e15f075f380

  • SHA256

    b59c919fbd22d951a44903cd83648ed4d26558c7a4b1f803af893bfb16cdb7bd

  • SHA512

    e822bdc33d518fda04b132574b90fa379d2353135aee32c178d3e14b30337ffe4ecefceaf04778108c3dd9049fd3cdb971b828e53a9dba13e99cf776b8fcf03c

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://wormming.duckdns.org:8023

Targets

    • Target

      #007704.js

    • Size

      56KB

    • MD5

      68dd5417687b71ef0bdee8c19baf4dcf

    • SHA1

      11c068485541aeaaa5d04af692971e15f075f380

    • SHA256

      b59c919fbd22d951a44903cd83648ed4d26558c7a4b1f803af893bfb16cdb7bd

    • SHA512

      e822bdc33d518fda04b132574b90fa379d2353135aee32c178d3e14b30337ffe4ecefceaf04778108c3dd9049fd3cdb971b828e53a9dba13e99cf776b8fcf03c

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks