Overview

overview

10

Static

static

1

run.vbs

windows7-x64

10

run.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    run.vbs

  • Size

    2KB

  • Sample

    250124-xhz71aspav

  • MD5

    fe141a7870cdfc98d359c8f0f9bf160f

  • SHA1

    d32577b8ba6d761c4ca0c03ebeb0e46799d92090

  • SHA256

    f16c66e9093e8357697dee345f91ae04cb930c14bdb416c688cbbbaa957f61b9

  • SHA512

    7f13c9ceeaa368bacbe9e91cfd848bfda1811a24a05533d45bea5cf8165c0ce4e9fc47107c1fe4d876ba0c8fe187b9c7b97419d0adbe9a2a4caaae49eb79b65b

Score
10/10
vjw0rmtrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://185.208.156.153:6656

Targets

    • Target

      run.vbs

    • Size

      2KB

    • MD5

      fe141a7870cdfc98d359c8f0f9bf160f

    • SHA1

      d32577b8ba6d761c4ca0c03ebeb0e46799d92090

    • SHA256

      f16c66e9093e8357697dee345f91ae04cb930c14bdb416c688cbbbaa957f61b9

    • SHA512

      7f13c9ceeaa368bacbe9e91cfd848bfda1811a24a05533d45bea5cf8165c0ce4e9fc47107c1fe4d876ba0c8fe187b9c7b97419d0adbe9a2a4caaae49eb79b65b

    Score
    10/10
    vjw0rmtrojanworm

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Vjw0rm family

      vjw0rm

    • Blocklisted process makes network request

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks