Overview

overview

10

Static

static

Payment.js

windows7-x64

10

Payment.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Payment.js

  • Size

    28KB

  • Sample

    221103-jpac9sfgg9

  • MD5

    359404b0cab1f6527c6f200437696451

  • SHA1

    9da5f4937f158978047db38d38eb9bc20196dc8d

  • SHA256

    bb71355902607d2c6b880b49cbfce0c9fd98f03297e0836d3adbcbfba9ea5feb

  • SHA512

    3bd9c816a8ab8515f7a02b9085c6b321fc6fd7d49d8d8b5e42d274b4db606cfa3f927ddb5741aa94edfb40fa2b4d042fa26e6e98d967920f22ab90ecef04d122

  • SSDEEP

    768:73PRmOQmiKb7OjxQIjkhqxOjrptJ4fOhnFT:7OmiQkkhjrFzN

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      Payment.js

    • Size

      28KB

    • MD5

      359404b0cab1f6527c6f200437696451

    • SHA1

      9da5f4937f158978047db38d38eb9bc20196dc8d

    • SHA256

      bb71355902607d2c6b880b49cbfce0c9fd98f03297e0836d3adbcbfba9ea5feb

    • SHA512

      3bd9c816a8ab8515f7a02b9085c6b321fc6fd7d49d8d8b5e42d274b4db606cfa3f927ddb5741aa94edfb40fa2b4d042fa26e6e98d967920f22ab90ecef04d122

    • SSDEEP

      768:73PRmOQmiKb7OjxQIjkhqxOjrptJ4fOhnFT:7OmiQkkhjrFzN

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks