General

  • Target

    PO 348749 - 348010 - RFQ.js

  • Size

    38KB

  • Sample

    221014-rykvcsdfc4

  • MD5

    f7fecebc69a9cd307431450fcd831595

  • SHA1

    155bbd9b690d15b2e48f59b76c84e5d66aff33d9

  • SHA256

    f981a7fa89a630369d70f2d11b9ea30290f1cad64cf18389e4ba82e45c0590ea

  • SHA512

    ce0616e889730abd580c5687a679ce853aeb96e221ab87bbbc12ce93ef60959d5a08c072095c74fac8df6a4bcd49d126fa0e7a131a861385864e15a9dd9b16b6

  • SSDEEP

    768:1yfkn2aoa5O+dFFPbxJ/sPLh4u9jx0izjlUXV4dUQ0SaIs:MIsCdnPbT/sP94sjx0izjlU1Q0SaJ

Malware Config

Targets

    • Target

      PO 348749 - 348010 - RFQ.js

    • Size

      38KB

    • MD5

      f7fecebc69a9cd307431450fcd831595

    • SHA1

      155bbd9b690d15b2e48f59b76c84e5d66aff33d9

    • SHA256

      f981a7fa89a630369d70f2d11b9ea30290f1cad64cf18389e4ba82e45c0590ea

    • SHA512

      ce0616e889730abd580c5687a679ce853aeb96e221ab87bbbc12ce93ef60959d5a08c072095c74fac8df6a4bcd49d126fa0e7a131a861385864e15a9dd9b16b6

    • SSDEEP

      768:1yfkn2aoa5O+dFFPbxJ/sPLh4u9jx0izjlUXV4dUQ0SaIs:MIsCdnPbT/sP94sjx0izjlU1Q0SaJ

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks