Overview

overview

10

Static

static

6A2F6DA502...92.exe

windows7_x64

10

6A2F6DA502...92.exe

windows10-2004_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6A2F6DA502485750ACDE45AD22D36D186C335B2F61592.exe

  • Size

    10.5MB

  • Sample

    220310-v1gghahdc3

  • MD5

    e1fad5d61bb637beb30aec6d3180ece2

  • SHA1

    88966028db1eb2a41cec54875486638937a28208

  • SHA256

    6a2f6da502485750acde45ad22d36d186c335b2f61592c5eae168e9f971ffc70

  • SHA512

    5c87ab2570983aff67fe5d99dc157e9ebb040ea96a8344da0f1cdf6fdf9701ee014e43c69255773e95ae09d7c45ece9b119928b45c8fb400351ecccf996a56cb

Score
10/10
vjw0rmpersistencetrojanupxworm

Malware Config

Extracted

Family

vjw0rm

C2

http://tahoo.linkpc.net:777

Targets

    • Target

      6A2F6DA502485750ACDE45AD22D36D186C335B2F61592.exe

    • Size

      10.5MB

    • MD5

      e1fad5d61bb637beb30aec6d3180ece2

    • SHA1

      88966028db1eb2a41cec54875486638937a28208

    • SHA256

      6a2f6da502485750acde45ad22d36d186c335b2f61592c5eae168e9f971ffc70

    • SHA512

      5c87ab2570983aff67fe5d99dc157e9ebb040ea96a8344da0f1cdf6fdf9701ee014e43c69255773e95ae09d7c45ece9b119928b45c8fb400351ecccf996a56cb

    Score
    10/10
    vjw0rmpersistencetrojanupxworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks