Overview

overview

10

Static

static

1

HOH76746.js

windows7-x64

10

HOH76746.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5118bcfda155a19a27cfafea90a66f11624a11b8abcf00b300d544da0b73aea9

  • Size

    410KB

  • Sample

    241224-cjvnpayqar

  • MD5

    c6e65fa1628505e8d20b56d2084210fd

  • SHA1

    3e97917a9fefc58172db88218273f409257e814b

  • SHA256

    5118bcfda155a19a27cfafea90a66f11624a11b8abcf00b300d544da0b73aea9

  • SHA512

    1e53a3693cba67b780a2b0e4d622e59cad79d5c2a710de5b5f956c7b441ad09aa25a9de124ea9957d009275e8ae55e8088577c897f592be8a2399f6530d57358

  • SSDEEP

    12288:/59RU3G1DDmXFCpBCvZfoipk5GE7ZCR5AZxKJuYl7W86qU:RkWpq441Dpk5G2ZCDAZxKJt6qU

Score
10/10
vjw0rmdiscoveryexecutionpersistencetrojanworm

Malware Config

Targets

    • Target

      HOH76746.js

    • Size

      1.7MB

    • MD5

      e261e68bcae0c10642170416082702b7

    • SHA1

      6c9b48b65090ec13326a07bef72b1c3995f72513

    • SHA256

      f126bcd906ba8815594cd987e4ba8852bccd58d813ac415a626e66ab5a395db2

    • SHA512

      05979d43fee175648476accc5562a02c9736337e21ca850ce893791365f5b54f55f9b6813cc0a20d2781ba09c16b6425ee01cb853ab546e049bc1e7e03dd8818

    • SSDEEP

      24576:aMfvBNjtnVwqiZeU0YQrSPznMfvBNjtnVwqiZeU0YQrSPzK:JrWXOrWXW

    Score
    10/10
    vjw0rmexecutionpersistencetrojanwormdiscovery

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Vjw0rm family

      vjw0rm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks