vjw0rm | 908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8 | Triage

Sharing

General

Target

908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
Size

9.0MB
Sample

230314-y7w3babe9z
MD5

c80a36f6be68badf2169f87ef5284b46
SHA1

8eb62c3901b392b7c608c8849af3f49881eec24e
SHA256

908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8
SHA512

41cff549582af5b3c469655d0a738a88c7f55077d2e2fea20a1d0be92b848f008165d9886fe922e643c503cb3ac4a07f1800f68682ef4fa49aaa3612a7b622c7
SSDEEP

192:KZVh7E1mH9k2J2ZafWdfH1P2P1IFpLk8vII:MVm1mH9u1+qTtgI

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
- Size
  
  9.0MB
- MD5
  
  c80a36f6be68badf2169f87ef5284b46
- SHA1
  
  8eb62c3901b392b7c608c8849af3f49881eec24e
- SHA256
  
  908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8
- SHA512
  
  41cff549582af5b3c469655d0a738a88c7f55077d2e2fea20a1d0be92b848f008165d9886fe922e643c503cb3ac4a07f1800f68682ef4fa49aaa3612a7b622c7
- SSDEEP
  
  192:KZVh7E1mH9k2J2ZafWdfH1P2P1IFpLk8vII:MVm1mH9u1+qTtgI
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm