Overview

overview

10

Static

static

1

63a88c1929...322.js

windows7-x64

10

63a88c1929...322.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63a88c19299c8fd2e3bf299798a6a322.bin

  • Size

    200KB

  • Sample

    240119-cetktsdgen

  • MD5

    63a88c19299c8fd2e3bf299798a6a322

  • SHA1

    7545d8fb37a2626b7bf4bd28ab3365e82068e0c8

  • SHA256

    fc5631bd6d785c3b3c634e71ca51fe274c72018110d5dd66e37595653f8ab0dc

  • SHA512

    3ccc6253e000a8dfd2fecd803294e43f867d3e97a98996a03db4a5f0cdf2172c8338827f0587d2a596cd6c9b657d23f228ab197181655590692db50c18b029d3

  • SSDEEP

    3072:9uhE0m9+ACB9epP1nu+CcFztpcUodQ4kq98YJDkBPrspGQidJHlkg:loAm9ezu+Ci5pcUoNkpkkJeo/Fkg

Score
10/10
vjw0rmdiscoverypersistencetrojanworm

Malware Config

Targets

    • Target

      63a88c19299c8fd2e3bf299798a6a322.bin

    • Size

      200KB

    • MD5

      63a88c19299c8fd2e3bf299798a6a322

    • SHA1

      7545d8fb37a2626b7bf4bd28ab3365e82068e0c8

    • SHA256

      fc5631bd6d785c3b3c634e71ca51fe274c72018110d5dd66e37595653f8ab0dc

    • SHA512

      3ccc6253e000a8dfd2fecd803294e43f867d3e97a98996a03db4a5f0cdf2172c8338827f0587d2a596cd6c9b657d23f228ab197181655590692db50c18b029d3

    • SSDEEP

      3072:9uhE0m9+ACB9epP1nu+CcFztpcUodQ4kq98YJDkBPrspGQidJHlkg:loAm9ezu+Ci5pcUoNkpkkJeo/Fkg

    Score
    10/10
    vjw0rmpersistencetrojanwormdiscovery

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks