vjw0rm | 19c2b2552b72e578804e41f698eb760655ec2826fc42fe365eb1bd5b7e1ce38b | Triage

Sharing

General

Target

Shipping Documents AWB#5305323204643.js
Size

429KB
Sample

220621-k3xldscfcn
MD5

f992d6aac0c0d0ea532d8128827c1492
SHA1

135f458e0f462fcd95a420af6e34169a0e66a3b7
SHA256

19c2b2552b72e578804e41f698eb760655ec2826fc42fe365eb1bd5b7e1ce38b
SHA512

eb59741e2f70d5aa019166ed940a92701526d7549f95ddb0ecfe656db55177d3c65dd6205a47c8b72aac3222f901d5f36a06567631cebf5eb8d44a48add46867

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  Shipping Documents AWB#5305323204643.js
- Size
  
  429KB
- MD5
  
  f992d6aac0c0d0ea532d8128827c1492
- SHA1
  
  135f458e0f462fcd95a420af6e34169a0e66a3b7
- SHA256
  
  19c2b2552b72e578804e41f698eb760655ec2826fc42fe365eb1bd5b7e1ce38b
- SHA512
  
  eb59741e2f70d5aa019166ed940a92701526d7549f95ddb0ecfe656db55177d3c65dd6205a47c8b72aac3222f901d5f36a06567631cebf5eb8d44a48add46867
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm