Overview

overview

10

Static

static

PO-P3456787654.js

windows7_x64

1

PO-P3456787654.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82438dd8d0750e94e275ab731ce6268fd6352f14c330b9a46f750146ffc23a62

  • Size

    27KB

  • Sample

    220208-dqxmascef9

  • MD5

    4ee544253b197aa812e90da53c0bed58

  • SHA1

    7069a060214f037ca3d3804d4efb0d253d0173ea

  • SHA256

    82438dd8d0750e94e275ab731ce6268fd6352f14c330b9a46f750146ffc23a62

  • SHA512

    91dcc74990c593fb6b07d3964c284a320fea83f69d37891cc20b8a4d37515de7503dcf0a1f47244c171a0175971ee12b39bf74d7535f5405420b96c45e154d4f

Score
10/10
vjw0rmtrojanworm

Malware Config

Targets

    • Target

      PO-P3456787654.js

    • Size

      25KB

    • MD5

      4a54057158301995e8cb7e5013d9ae88

    • SHA1

      c75707a8358891ca400f3396d2a38af73320d639

    • SHA256

      e62121a533477596a3b5fb48518cb42ffd9a1cc72aad9e16df9893367563d424

    • SHA512

      92f3ce460056a939612f78b4079e27502b305c2ce5fb92a054182c7ea23733f007360776f2632fad65240334d8db84d4571ed5ef1159e3fc00ae140a0931547c

    Score
    10/10
    vjw0rmtrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks