Overview

overview

10

Static

static

Order Rece...-22.js

windows7_x64

10

Order Rece...-22.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order Receipt UPS1605-192-DD-22.js

  • Size

    20KB

  • Sample

    220222-jlzhzsecc3

  • MD5

    8d2786e0a6c850c170c679a54e0d5f20

  • SHA1

    0fd46e20522fd76ea36953c971fe93c8b03f7a23

  • SHA256

    56996c6145346114bcefd9028fa95a8232d1ce0e380e216a06975d7cad14c649

  • SHA512

    10370279326a30c41dc49f58884734ee3c56d7c99441f123bb42bb0949d0b966b73ec18ddc7aba71b62b2bb5428bb2ddb4e645c05fb2350d0b2cae738a90d2ec

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://shizzlegateway.duckdns.org:1605

Targets

    • Target

      Order Receipt UPS1605-192-DD-22.js

    • Size

      20KB

    • MD5

      8d2786e0a6c850c170c679a54e0d5f20

    • SHA1

      0fd46e20522fd76ea36953c971fe93c8b03f7a23

    • SHA256

      56996c6145346114bcefd9028fa95a8232d1ce0e380e216a06975d7cad14c649

    • SHA512

      10370279326a30c41dc49f58884734ee3c56d7c99441f123bb42bb0949d0b966b73ec18ddc7aba71b62b2bb5428bb2ddb4e645c05fb2350d0b2cae738a90d2ec

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks