Overview

overview

10

Static

static

1

b293167774...118.js

windows7-x64

10

b293167774...118.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2931677748da184be75854369749dc9_JaffaCakes118

  • Size

    11KB

  • Sample

    240404-jh3fgahe8y

  • MD5

    b2931677748da184be75854369749dc9

  • SHA1

    1dd339c87a703195ed29ab84792e30611a9917e6

  • SHA256

    bbceba6fd06b01bd5c69ccab1ea106189455e1e85e577e278f9f362940b5442c

  • SHA512

    0c8399e08da2194700ac5d2729b35abcb4c2642a4825ba46968ee1c8c21071f68c21b99297638d543440e3bf854cfc17d0ec390716a2fb2bcd9961611bd3c894

  • SSDEEP

    192:lGOZvPPzzDhmu9bQx/vdfEXcWBAQcpdOAqER/VkB1UxYSeXVW1EU:BZlmu9cx/VErBxqdOAxa2aSREU

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Targets

    • Target

      b2931677748da184be75854369749dc9_JaffaCakes118

    • Size

      11KB

    • MD5

      b2931677748da184be75854369749dc9

    • SHA1

      1dd339c87a703195ed29ab84792e30611a9917e6

    • SHA256

      bbceba6fd06b01bd5c69ccab1ea106189455e1e85e577e278f9f362940b5442c

    • SHA512

      0c8399e08da2194700ac5d2729b35abcb4c2642a4825ba46968ee1c8c21071f68c21b99297638d543440e3bf854cfc17d0ec390716a2fb2bcd9961611bd3c894

    • SSDEEP

      192:lGOZvPPzzDhmu9bQx/vdfEXcWBAQcpdOAqER/VkB1UxYSeXVW1EU:BZlmu9cx/VErBxqdOAxa2aSREU

    Score
    10/10
    vjw0rmpersistencetrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks