General
-
Target
9751596056.zip
-
Size
1KB
-
Sample
230329-mfv56ahe2z
-
MD5
a4739246dca09524e0ba2409f91e878a
-
SHA1
afc98246350fb03ed088e472517fa0186acc4933
-
SHA256
b312b68d7035ee5e5d0076d2204ad7f7ac1544949413e81466460a056642a9bb
-
SHA512
c726b26287870a3446b2a8f48f39bcb1ccb84305360d249e2a8b7f34657c079e6ae6b61cfb8da3267194d1c7d4c0fc4b92365a455ff7ee28c7721ea9c25395b5
Static task
static1
Behavioral task
behavioral1
Sample
6de643d185952a9903ab06d382c4373e516329536734d90be309004afaa5ea50.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6de643d185952a9903ab06d382c4373e516329536734d90be309004afaa5ea50.js
Resource
win10v2004-20230220-en
Malware Config
Extracted
vjw0rm
http://ourvjworm.duckdns.org:7974
Targets
-
-
Target
6de643d185952a9903ab06d382c4373e516329536734d90be309004afaa5ea50
-
Size
3KB
-
MD5
b226987db14d44762e9ebefcda95e144
-
SHA1
d86eac68820c39703e52142d3bf450525a9f8d6c
-
SHA256
6de643d185952a9903ab06d382c4373e516329536734d90be309004afaa5ea50
-
SHA512
c937e645be893774627bb9849c043f0ce0f9a35b39e843d2489124eaafe650ad55002dc90d1df68e6815950fb8f197a3cee73282eea19b2a701600aaba7775f2
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-