Overview

overview

10

Static

static

Orders.js

windows7_x64

10

Orders.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Orders.js

  • Size

    209KB

  • Sample

    220628-ll2pfsgecj

  • MD5

    d12479eec5fc8f1d57bf795c33feb329

  • SHA1

    23094b0e5146f82ca8493f7d7ff968640f68e9a5

  • SHA256

    d77abab32e4eeb866008a6cdafc09de31f1e73f7fbe2627fed75b4e90b22257d

  • SHA512

    f00eb36f2188a08f5bc577225135348964dfd6d9f6868aee34a8b512e55be89db0d0f2e7f5ce975ee26c1f85a571ecbcc407a2d29e4284fda713d4680014dbbd

Score
10/10
redlinevjw0rmmr ttdiscoveryinfostealerpersistencespywarestealertrojanworm

Malware Config

Extracted

Family

redline

Botnet

Mr TT

C2

45.138.16.233:1985

Targets

    • Target

      Orders.js

    • Size

      209KB

    • MD5

      d12479eec5fc8f1d57bf795c33feb329

    • SHA1

      23094b0e5146f82ca8493f7d7ff968640f68e9a5

    • SHA256

      d77abab32e4eeb866008a6cdafc09de31f1e73f7fbe2627fed75b4e90b22257d

    • SHA512

      f00eb36f2188a08f5bc577225135348964dfd6d9f6868aee34a8b512e55be89db0d0f2e7f5ce975ee26c1f85a571ecbcc407a2d29e4284fda713d4680014dbbd

    Score
    10/10
    redlinevjw0rmmr ttdiscoveryinfostealerpersistencespywarestealertrojanworm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks