Overview

overview

10

Static

static

Numero de ...698.js

windows7-x64

10

Numero de ...698.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Numero de proceso. 0091-002022-45125455775698.js

  • Size

    20KB

  • Sample

    220914-t15nnaeefj

  • MD5

    9a6201566699e9f2295752ed05eb7b61

  • SHA1

    50a9dab831e80495ca567663906682373fdd6f03

  • SHA256

    69ea6e323c2ea0eec7b061aa525a27f845406943d233ef4dbb4a78fda383d4c9

  • SHA512

    d903bb56cef06b76d3faf6916a48f3172b1e997aa716675ad33ddaef504db8bb2cb008c5bf7a6c740fd5f768dddca54c294cd39629d37fa83b3b9523b1cfe5c9

  • SSDEEP

    384:ppph8Bjxjn/Has3Hod8WUznzigOMOH4pW0TuemNZiBZnk:ppph8BjxjfaBd8WsjOHZ7iBRk

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      Numero de proceso. 0091-002022-45125455775698.js

    • Size

      20KB

    • MD5

      9a6201566699e9f2295752ed05eb7b61

    • SHA1

      50a9dab831e80495ca567663906682373fdd6f03

    • SHA256

      69ea6e323c2ea0eec7b061aa525a27f845406943d233ef4dbb4a78fda383d4c9

    • SHA512

      d903bb56cef06b76d3faf6916a48f3172b1e997aa716675ad33ddaef504db8bb2cb008c5bf7a6c740fd5f768dddca54c294cd39629d37fa83b3b9523b1cfe5c9

    • SSDEEP

      384:ppph8Bjxjn/Has3Hod8WUznzigOMOH4pW0TuemNZiBZnk:ppph8BjxjfaBd8WsjOHZ7iBRk

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks