Overview

overview

10

Static

static

receipt.js

windows7_x64

10

receipt.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    receipt.js

  • Size

    21KB

  • Sample

    220211-h147cacbg2

  • MD5

    fb34a8b0c4fb9221726c41f66ad5a604

  • SHA1

    957ace13d02b3ff42d1d34037e7f348e00c8de94

  • SHA256

    d659d288e3b316568f0ef98b2f8a14b57b2f620818fa01fba1741d5f0f0f0925

  • SHA512

    53cd70534f7fdf52ef57981694761325076dff190cd1911966c29dab0cd1b1b6417bde0dbe65780f0b0ccc89649e4f776441c577717d4e0169c4fd84a5f061dc

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      receipt.js

    • Size

      21KB

    • MD5

      fb34a8b0c4fb9221726c41f66ad5a604

    • SHA1

      957ace13d02b3ff42d1d34037e7f348e00c8de94

    • SHA256

      d659d288e3b316568f0ef98b2f8a14b57b2f620818fa01fba1741d5f0f0f0925

    • SHA512

      53cd70534f7fdf52ef57981694761325076dff190cd1911966c29dab0cd1b1b6417bde0dbe65780f0b0ccc89649e4f776441c577717d4e0169c4fd84a5f061dc

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks