Overview

overview

10

Static

static

1

8a64707b02...a24.js

windows7-x64

10

8a64707b02...a24.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a64707b027a9b569641b6151c54ba24

  • Size

    16KB

  • Sample

    231226-yparcsbde6

  • MD5

    8a64707b027a9b569641b6151c54ba24

  • SHA1

    b34f4dbb2f5b9a34645ea444db51841d9325a8cf

  • SHA256

    6e64dbcbe7e1c0e0eb8f4f967b936221c7a6c0185718fe991612e478e22f9cc8

  • SHA512

    9cade1e35eca162b7c06529b104db155e7c3a3f62965a88cbc66d709ee17ae7e86f53307b2208829d8c1ed498c96bbc3f73e7935df12b01533b4ef693f900456

  • SSDEEP

    384:MweGYgHCLCQr8POER/JmuCOfhYFAFYQhIZGaN+Ce2buvm/vNDe7:umDQr8Wt5O+FBQhyZe2bZo7

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      8a64707b027a9b569641b6151c54ba24

    • Size

      16KB

    • MD5

      8a64707b027a9b569641b6151c54ba24

    • SHA1

      b34f4dbb2f5b9a34645ea444db51841d9325a8cf

    • SHA256

      6e64dbcbe7e1c0e0eb8f4f967b936221c7a6c0185718fe991612e478e22f9cc8

    • SHA512

      9cade1e35eca162b7c06529b104db155e7c3a3f62965a88cbc66d709ee17ae7e86f53307b2208829d8c1ed498c96bbc3f73e7935df12b01533b4ef693f900456

    • SSDEEP

      384:MweGYgHCLCQr8POER/JmuCOfhYFAFYQhIZGaN+Ce2buvm/vNDe7:umDQr8Wt5O+FBQhyZe2bZo7

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks