General

  • Target

    aa67de9e00a281c037f629d9f1233520

  • Size

    24KB

  • Sample

    221004-x3nppscdcr

  • MD5

    aa67de9e00a281c037f629d9f1233520

  • SHA1

    cf91d74345efae287d771d1e80e7b01252c32381

  • SHA256

    5c692cf85400424312272820917d3ef0a81288534de833b18d783bc1987a3272

  • SHA512

    744665125881fb7141e7cdb8328fb0718cd4bf78d58ea6964f8aeafd1cf3ef4c6c89ba2f8a624ae0a62089901215b33be27f2864b36ce3b96fea9d9c5d008eee

  • SSDEEP

    384:0YG4wwJj9M0c+8wi8c5yPZdft2jd7AFxGaxl1+C7Zw9F/xKpbTJA:0YGEl1cHoZW5AFEawgwqy

Malware Config

Targets

    • Target

      CREDIT NOTE.js

    • Size

      47KB

    • MD5

      771ee97bd2e61801d47f37b60a69d1c8

    • SHA1

      b77ea83d939bc5ce8ceff9668488f8045ba58a0b

    • SHA256

      25027a9677193ee152a6621382d40fcf31437b4366f6566d369f24d93f52f56d

    • SHA512

      2ac19e006117d449467ec49f4b600293775bdbb0f03869a6e7c914449fb522d22f74ab060d0086ef1a033c91d987c38ddd97e258a7575581e95d68b1657737b1

    • SSDEEP

      768:bH5hjkXAZJMdHG7TH8eA0oWz6nSwsmjX1uMW7/1W8eXBnKX2CzHsPOux4GsPje//:bH5hIwZ+dHk8n0ISwXZ8OBKX2yKCXlgT

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks