Overview

overview

10

Static

static

YLEfmCJOSV_wama.js

windows7-x64

10

YLEfmCJOSV_wama.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YLEfmCJOSV_wama.js

  • Size

    42KB

  • Sample

    221125-h3s7vsad62

  • MD5

    0fe23d16b11b818393ba4b392f0f1f15

  • SHA1

    e2242955c77a00ce88e5444f1a5b87ea3cd4f228

  • SHA256

    f450197d283e536a7c22a3d884f50535ddee7f4ed5ce94b8571809db4395fe95

  • SHA512

    e1b7b769edb1e4ea76a3399b5261ab60224db361a44859b624cbff03c369b81723bbe4e4a68442ecbd50534ee8d7d9bc10e0ef88541296e0ab04b91fa97a5541

  • SSDEEP

    768:0U3iWU5RnL9uGwpUxBdn2SD0XuoC7LWadqbx2BKqwYqLbooO:XWxBd2Sjn7LBd6x2BHYLbooO

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://45.139.105.174:7575

Targets

    • Target

      YLEfmCJOSV_wama.js

    • Size

      42KB

    • MD5

      0fe23d16b11b818393ba4b392f0f1f15

    • SHA1

      e2242955c77a00ce88e5444f1a5b87ea3cd4f228

    • SHA256

      f450197d283e536a7c22a3d884f50535ddee7f4ed5ce94b8571809db4395fe95

    • SHA512

      e1b7b769edb1e4ea76a3399b5261ab60224db361a44859b624cbff03c369b81723bbe4e4a68442ecbd50534ee8d7d9bc10e0ef88541296e0ab04b91fa97a5541

    • SSDEEP

      768:0U3iWU5RnL9uGwpUxBdn2SD0XuoC7LWadqbx2BKqwYqLbooO:XWxBd2Sjn7LBd6x2BHYLbooO

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks