vjw0rm | 9b1f2d3e06f9a6299287c531f007e1f2a38fd1d5af3481e7f6be24475495567d | Triage

Sharing

General

Target

JaffaCakes118_9b1f2d3e06f9a6299287c531f007e1f2a38fd1d5af3481e7f6be24475495567d
Size

13KB
Sample

241225-1ve95syqgv
MD5

bda43336bf6249a4e667d207d62cc910
SHA1

9dc42b7d9dfd2b3f5a22e71abb0106fdc736bf4a
SHA256

9b1f2d3e06f9a6299287c531f007e1f2a38fd1d5af3481e7f6be24475495567d
SHA512

af80aa64ca5d29d5f1839b38330a158507faac2ec305242d94d4c041da65c8b8a8ed8c927e1cd6e1383f1fe1335a814c6d28b1bbc366e3de3d9898478edd1650
SSDEEP

384:jE+DtyRt9W+kdzGQ9FdtDbdP3AwOEIgrtm+7FOSE2:IZ76z3FjpnrFlr

Score

10^/10

vjw0rm execution persistence trojan worm

Malware Config

Targets

- Target
  
  JaffaCakes118_9b1f2d3e06f9a6299287c531f007e1f2a38fd1d5af3481e7f6be24475495567d
- Size
  
  13KB
- MD5
  
  bda43336bf6249a4e667d207d62cc910
- SHA1
  
  9dc42b7d9dfd2b3f5a22e71abb0106fdc736bf4a
- SHA256
  
  9b1f2d3e06f9a6299287c531f007e1f2a38fd1d5af3481e7f6be24475495567d
- SHA512
  
  af80aa64ca5d29d5f1839b38330a158507faac2ec305242d94d4c041da65c8b8a8ed8c927e1cd6e1383f1fe1335a814c6d28b1bbc366e3de3d9898478edd1650
- SSDEEP
  
  384:jE+DtyRt9W+kdzGQ9FdtDbdP3AwOEIgrtm+7FOSE2:IZ76z3FjpnrFlr
Score

10^/10

vjw0rm execution persistence trojan worm
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Vjw0rm family
  vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vjw0rmexecutionpersistencetrojanworm

behavioral2

vjw0rmexecutionpersistencetrojanworm