Overview

overview

10

Static

static

Purchase Order.js

windows7_x64

10

Purchase Order.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order.js

  • Size

    102KB

  • Sample

    220617-kbabsadfd6

  • MD5

    96ed923c16d7a86c7f70675e508fdb77

  • SHA1

    6cc9cd0e2aee7833a9677c2db346778382d6a800

  • SHA256

    941e953be533b065e079b5dc1480cb6cba4db8db25343d6ada935cf0b293e60e

  • SHA512

    553118001a8a216285f6a1754a2b8adc7079028c10acb7c92ae9732aa7b687358246a4b41ca9ac69af8ab4f77b4d9595deb2ece0ac9ebdd9b6cff4a36083315e

Score
10/10
vjw0rmpersistencesuricatatrojanworm

Malware Config

Targets

    • Target

      Purchase Order.js

    • Size

      102KB

    • MD5

      96ed923c16d7a86c7f70675e508fdb77

    • SHA1

      6cc9cd0e2aee7833a9677c2db346778382d6a800

    • SHA256

      941e953be533b065e079b5dc1480cb6cba4db8db25343d6ada935cf0b293e60e

    • SHA512

      553118001a8a216285f6a1754a2b8adc7079028c10acb7c92ae9732aa7b687358246a4b41ca9ac69af8ab4f77b4d9595deb2ece0ac9ebdd9b6cff4a36083315e

    Score
    10/10
    vjw0rmpersistencesuricatatrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

      suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

      suricata

    • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

      suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks