Overview

overview

10

Static

static

e-Voucher#097.js

windows7_x64

10

e-Voucher#097.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e-Voucher#097.js

  • Size

    11KB

  • Sample

    220404-wtr54aecbk

  • MD5

    50989521210252e5c40a143c7474a97d

  • SHA1

    f9f941286ac2d38d5e24763d0176e1bdbbf3a9df

  • SHA256

    ae6b4083981c16d6bb62bb3b37202464f029bb0377dc8bc082ed8372202518be

  • SHA512

    1a65c17a143fbda64278cad71e020983d64fc09a589961b30700833915a169c4a879e630e7bc3c80c686b04e4ddda706d223379670de50d4c12823e4c94b0ba3

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://zeegod.duckdns.org:9002

Targets

    • Target

      e-Voucher#097.js

    • Size

      11KB

    • MD5

      50989521210252e5c40a143c7474a97d

    • SHA1

      f9f941286ac2d38d5e24763d0176e1bdbbf3a9df

    • SHA256

      ae6b4083981c16d6bb62bb3b37202464f029bb0377dc8bc082ed8372202518be

    • SHA512

      1a65c17a143fbda64278cad71e020983d64fc09a589961b30700833915a169c4a879e630e7bc3c80c686b04e4ddda706d223379670de50d4c12823e4c94b0ba3

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks