Overview

overview

10

Static

static

1

32_94_paym...xls.js

windows7-x64

10

32_94_paym...xls.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e40c02fde9cd71faef1d2c1f3f4cebbf8a98fbd5f219e8c5e04bd780684dfe29

  • Size

    254KB

  • Sample

    230311-z959fabc99

  • MD5

    25664e340917e22ca622bfe13a608b34

  • SHA1

    72255986fc86c53f32b678f48e4e4f3728b03a40

  • SHA256

    e40c02fde9cd71faef1d2c1f3f4cebbf8a98fbd5f219e8c5e04bd780684dfe29

  • SHA512

    ac075500d3f79b053227c00002a0e24c597f4e18e0576fa3c8bead6e7d894b9d5456b4d37f01c9494c4deeb894639e25587870702e66c5b0875e57ab4597373f

  • SSDEEP

    3072:1FLKTOOue+ySCi6aKq3XHnf/vPDjTz52mGMsc80UEkQwgAY4oIRxhB5ZJpV1lFVB:1eHay

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://js9300.duckdns.org:9300

Targets

    • Target

      32_94_payment_bv_xls.js

    • Size

      300.0MB

    • MD5

      62cc1b7497b1c6483cdee99cf94aaaea

    • SHA1

      60c51b7d03bc0b5215fe3cbd9f52cfb89bcf8d74

    • SHA256

      fd38f9a079dd0bd1808baa9c7dcade49a11eda5cade2bf4197bd1aa00d8fe6aa

    • SHA512

      f43113d41e7c0043e26e8f94e9395db2fe531d87104151db8719736432d2466412ae0402cff9f892795e455faef83cbe80bca59a72abfcbfe31061bed3d96df7

    • SSDEEP

      768:L6Nrj4rmY+ABYSZy1YrmyBFcuYyYxy1Y0RrFrX:L6

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks