Overview

overview

10

Static

static

TG216_94_312_PDF.js

windows7-x64

10

TG216_94_312_PDF.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TG216_94_312_PDF.js

  • Size

    97KB

  • Sample

    230202-phrlvsab6y

  • MD5

    7afbb2051c1ba1c1e88c499c5e11636a

  • SHA1

    4b2a14b3ca310b1f39959c130ae7b72a03078873

  • SHA256

    74fc83dc153086db0329b982e73e8bee4b652d1265c8185b0b4374898a112d06

  • SHA512

    c506d2d13383948d9acfafdc152f81326fc73381530fbb019794f9bc2b7733b3b455f6eddc92d597614f0f6d641f391d737f93f809486707cb1d8f84378309ec

  • SSDEEP

    384:chWWz5Kfy24jHueR45qWWxWBWHKSqmqR4G:XYG

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://js9400.duckdns.org:9400

Targets

    • Target

      TG216_94_312_PDF.js

    • Size

      97KB

    • MD5

      7afbb2051c1ba1c1e88c499c5e11636a

    • SHA1

      4b2a14b3ca310b1f39959c130ae7b72a03078873

    • SHA256

      74fc83dc153086db0329b982e73e8bee4b652d1265c8185b0b4374898a112d06

    • SHA512

      c506d2d13383948d9acfafdc152f81326fc73381530fbb019794f9bc2b7733b3b455f6eddc92d597614f0f6d641f391d737f93f809486707cb1d8f84378309ec

    • SSDEEP

      384:chWWz5Kfy24jHueR45qWWxWBWHKSqmqR4G:XYG

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks