vjw0rm | 510b335ce718d50da78a27b1750e2af1b18994b10e550c78c61a4491976eb974 | Triage

Sharing

General

Target

14bf111a8393a7293bcedcb4836c9be0
Size

9KB
Sample

231224-13ptjscfa7
MD5

14bf111a8393a7293bcedcb4836c9be0
SHA1

ba000e395f99d5be511c4212dc80a4609d342a4b
SHA256

510b335ce718d50da78a27b1750e2af1b18994b10e550c78c61a4491976eb974
SHA512

60180d69e6db7711fa934a4e81aa69445c14a171220567f1a028673a45ee450eea3f1639a83dbc3ce00f87cdb06e713a460631f3eda308f74c85cdf8e5f23cac
SSDEEP

192:QJcM9Z0N7lk8ksoAsNJIS7WBUeaZTOVwBBnCCzxtNLFH5EOKxOOQ:QZ9Z8768ksoAs/IQneaZCVspdzxrFHBb

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Targets

- Target
  
  14bf111a8393a7293bcedcb4836c9be0
- Size
  
  9KB
- MD5
  
  14bf111a8393a7293bcedcb4836c9be0
- SHA1
  
  ba000e395f99d5be511c4212dc80a4609d342a4b
- SHA256
  
  510b335ce718d50da78a27b1750e2af1b18994b10e550c78c61a4491976eb974
- SHA512
  
  60180d69e6db7711fa934a4e81aa69445c14a171220567f1a028673a45ee450eea3f1639a83dbc3ce00f87cdb06e713a460631f3eda308f74c85cdf8e5f23cac
- SSDEEP
  
  192:QJcM9Z0N7lk8ksoAsNJIS7WBUeaZTOVwBBnCCzxtNLFH5EOKxOOQ:QZ9Z8768ksoAs/IQneaZCVspdzxrFHBb
Score

10^/10

vjw0rm persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vjw0rmpersistencetrojanworm

behavioral2

vjw0rmpersistencetrojanworm