Overview

overview

10

Static

static

1

vjworm.js

windows7-x64

10

vjworm.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vjworm.js

  • Size

    47KB

  • Sample

    230403-dx72lsdg9t

  • MD5

    4d4480b2a363d66f2647d10d978c085a

  • SHA1

    3f9d64be86691d734d8d7018ff0436b615e7effc

  • SHA256

    76c7451f27cd07c3bbe48b7378ed85047036c65fed201128b892545ff8e46a5a

  • SHA512

    3425b770417baabe9bfffe85f7ad084547fd5b10b53c0a7b05b65c2934412cdb24752db648f851447516ceb46de5bb4e8986688cade03a52a9ca232da60cb63b

  • SSDEEP

    768:8tZ8oMh8ycJrJWRJpBWefOydp5pb5aNs9SVY4D3HaTvICf99EWrWExBSSLtLG:8tZ8o28yKrJ+HWQOydp5pb5aNs90Y4DP

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      vjworm.js

    • Size

      47KB

    • MD5

      4d4480b2a363d66f2647d10d978c085a

    • SHA1

      3f9d64be86691d734d8d7018ff0436b615e7effc

    • SHA256

      76c7451f27cd07c3bbe48b7378ed85047036c65fed201128b892545ff8e46a5a

    • SHA512

      3425b770417baabe9bfffe85f7ad084547fd5b10b53c0a7b05b65c2934412cdb24752db648f851447516ceb46de5bb4e8986688cade03a52a9ca232da60cb63b

    • SSDEEP

      768:8tZ8oMh8ycJrJWRJpBWefOydp5pb5aNs9SVY4D3HaTvICf99EWrWExBSSLtLG:8tZ8o28yKrJ+HWQOydp5pb5aNs90Y4DP

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks