Overview

overview

10

Static

static

1

done.js

windows7-x64

10

done.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    done.js

  • Size

    3.0MB

  • Sample

    230310-jr5bescc39

  • MD5

    a2b15f7f09bb920f99300225c14be950

  • SHA1

    5afaa8c209fcbaade7c7cfe4a9f031c1c3cfab5a

  • SHA256

    3159c56b3356b34ef102b3163864b9be2c73ad0600d283c757bbe68a9b2001e1

  • SHA512

    8dc9b46f18416f7059bc4bbd3603ded4d5e7e6ac7ff7b0d5a485ec9c38fef572311ac12fef945ae5e6c4b36249c5b7a2653a8fd578997c898cbab3d2b936e9a6

  • SSDEEP

    12288:W6E6Fw4dpkVmV7uVszfjvWaam7o+RRaxl6/ZWi2nn1Dx7DqI8MAwshf5/zeihN5n:9

Score
10/10
vjw0rmtrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://84.21.172.33:8895

Targets

    • Target

      done.js

    • Size

      3.0MB

    • MD5

      a2b15f7f09bb920f99300225c14be950

    • SHA1

      5afaa8c209fcbaade7c7cfe4a9f031c1c3cfab5a

    • SHA256

      3159c56b3356b34ef102b3163864b9be2c73ad0600d283c757bbe68a9b2001e1

    • SHA512

      8dc9b46f18416f7059bc4bbd3603ded4d5e7e6ac7ff7b0d5a485ec9c38fef572311ac12fef945ae5e6c4b36249c5b7a2653a8fd578997c898cbab3d2b936e9a6

    • SSDEEP

      12288:W6E6Fw4dpkVmV7uVszfjvWaam7o+RRaxl6/ZWi2nn1Dx7DqI8MAwshf5/zeihN5n:9

    Score
    10/10
    vjw0rmtrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks