Overview

overview

10

Static

static

1

75c51e4760...118.js

windows7-x64

10

75c51e4760...118.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75c51e4760f40c18863f675ef0d06501_JaffaCakes118

  • Size

    25KB

  • Sample

    240401-vsemyaag66

  • MD5

    75c51e4760f40c18863f675ef0d06501

  • SHA1

    64a0bdded7dd1a220f77958f3bf322376cdb832f

  • SHA256

    041857494d57688060972d7a46663f5295df45223e3445afa95d43e674fd053c

  • SHA512

    7b2ba2b9fca230a2f5eb6ef4fa02b635bef472b6a506da914838645bdcb2e3ca5ff2734c0015ba9d1e65b615747b3ba3db0f6264184e6f0b980a5b216db83a42

  • SSDEEP

    768:h+lwW21fUb2VDLXfoX4k/BL7Gfj2voDs53+lt5HSaBfa97D:4lW1sCV/qjpuqEs53+lt5lSF

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      75c51e4760f40c18863f675ef0d06501_JaffaCakes118

    • Size

      25KB

    • MD5

      75c51e4760f40c18863f675ef0d06501

    • SHA1

      64a0bdded7dd1a220f77958f3bf322376cdb832f

    • SHA256

      041857494d57688060972d7a46663f5295df45223e3445afa95d43e674fd053c

    • SHA512

      7b2ba2b9fca230a2f5eb6ef4fa02b635bef472b6a506da914838645bdcb2e3ca5ff2734c0015ba9d1e65b615747b3ba3db0f6264184e6f0b980a5b216db83a42

    • SSDEEP

      768:h+lwW21fUb2VDLXfoX4k/BL7Gfj2voDs53+lt5HSaBfa97D:4lW1sCV/qjpuqEs53+lt5lSF

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks