vjw0rm | 1e4b0b6254e8f64254e54a9b587c58b1b315d3778f2f359c1e2fa8a5eedf2832 | Triage

Sharing

General

Target

29e6358dcc6c6518ff978ed2e06a097f
Size

231KB
Sample

231221-3q37hseag9
MD5

29e6358dcc6c6518ff978ed2e06a097f
SHA1

963d7a5020461bf138b723518c4b606599ad18b4
SHA256

1e4b0b6254e8f64254e54a9b587c58b1b315d3778f2f359c1e2fa8a5eedf2832
SHA512

25310412f2e6b727cc990a17a6c6435a5c2380245beeae7fdfe45748bb7858d48910da032bf277322b7639bfb49c247f066aa3030758b344eb4403f88a9e4c62
SSDEEP

6144:IF6rpMoVfIVW0q6+wQdb+MMeRcvLEGAaw731WB:IF0Tw7QdtMeRcvLEGAaA3g

Score

10^/10

vjw0rm discovery persistence trojan worm

Malware Config

Targets

- Target
  
  29e6358dcc6c6518ff978ed2e06a097f
- Size
  
  231KB
- MD5
  
  29e6358dcc6c6518ff978ed2e06a097f
- SHA1
  
  963d7a5020461bf138b723518c4b606599ad18b4
- SHA256
  
  1e4b0b6254e8f64254e54a9b587c58b1b315d3778f2f359c1e2fa8a5eedf2832
- SHA512
  
  25310412f2e6b727cc990a17a6c6435a5c2380245beeae7fdfe45748bb7858d48910da032bf277322b7639bfb49c247f066aa3030758b344eb4403f88a9e4c62
- SSDEEP
  
  6144:IF6rpMoVfIVW0q6+wQdb+MMeRcvLEGAaw731WB:IF0Tw7QdtMeRcvLEGAaA3g
Score

10^/10

vjw0rm persistence trojan worm discovery
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmdiscoverypersistencetrojanworm