🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 085914ae6981487ee2ad184426717a2707df75e15e6b8cf48e5c2ff0186edcbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 085914ae6981487ee2ad184426717a2707df75e15e6b8cf48e5c2ff0186edcbb
SHA3-384 hash: 8c355a14c5bfffb0fd789b99cf78e2c6c494a6355060772f7a9e0167cf51c8a588dd1eaa09dea51c4103dd5d4647cd51
SHA1 hash: 960b267acd00d53ad15f53ec722c5f9e50ac39e1
MD5 hash: c9df3ade3ffccea0bef35c68951e0c52
humanhash: double-bluebird-alabama-burger
File name:Order Confirmation_OV220001820_29 0922.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:48'477 bytes
First seen:2022-09-29 09:55:43 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:Pt81/mb0uaTdKUT77PEbEi2PsxIugFcFuN9QX3hNYDlQBSSLt0G:PtI/o0uQdKUDEIi2PsxUq6CX3hNklPSv
TLSH T19D239F728CC69790DF0218069FB8DF3E673A965F30B6182E1A05478A126243EF77D17E
Reporter abuse_ch
Tags:js vjw0rm

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://0b3c.duckdns.org:1988/is-ready https://threatfox.abuse.ch/ioc/858528/
185.29.8.44:1988 https://threatfox.abuse.ch/ioc/858529/

Intelligence

File Origin
# of uploads :
1
# of downloads :
276
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Cryxos-M.23181.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Cryxos-M.24314.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive obfuscated wscript.exe
Link:
https://www.filescan.io/uploads/63356bb449c58ce767c411e9/reports/30f97ce9-a179-4683-8d34-b872c3afcb13/overview
Result
Threat name:
WSHRat, VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1079930
Signature
Antivirus detection for dropped file
Detected WSHRat
Drops script or batch files to the startup folder
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for domain / URL
Potential malicious VBS/JS script found (suspicious encoded strings)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Sigma detected: VjW0rm
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Wscript called in batch mode (surpress errors)
Yara detected VjW0rm
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 712511 Sample: Order Confirmation_OV220001... Startdate: 29/09/2022 Architecture: WINDOWS Score: 100 67 Sigma detected: Register Wscript In Run Key 2->67 69 Snort IDS alert for network traffic 2->69 71 Multi AV Scanner detection for domain / URL 2->71 73 10 other signatures 2->73 7 wscript.exe 3 6 2->7         started        11 wscript.exe 2 2->11         started        13 wscript.exe 2->13         started        16 3 other processes 2->16 process3 dnsIp4 43 C:\Users\user\AppData\Roaming\mrlgZfWIwh.js, ASCII 7->43 dropped 45 Order Confirmation....js:Zone.Identifier, ASCII 7->45 dropped 47 Order Confirmation...20001820_29 0922.js, ASCII 7->47 dropped 49 2 other malicious files 7->49 dropped 81 System process connects to network (likely due to code injection or exploit) 7->81 83 Detected WSHRat 7->83 85 JScript performs obfuscated calls to suspicious functions 7->85 89 2 other signatures 7->89 18 wscript.exe 8 7->18         started        22 wscript.exe 1 13 7->22         started        87 Wscript called in batch mode (surpress errors) 11->87 25 wscript.exe 11->25         started        27 wscript.exe 11->27         started        63 0b3c.duckdns.org 13->63 29 wscript.exe 13->29         started        65 javaautorun.duia.ro 16->65 31 wscript.exe 16->31         started        33 wscript.exe 16->33         started        file5 signatures6 process7 dnsIp8 51 0b3c.duckdns.org 185.29.11.19, 1988, 49699, 49702 DATACLUB-NL European Union 18->51 35 wscript.exe 18->35         started        53 javaautorun.duia.ro 154.120.120.217, 5465 SpectranetNG Nigeria 22->53 41 C:\Users\user\AppData\...\mrlgZfWIwh.js, ASCII 22->41 dropped 55 185.29.8.44, 1988, 49759, 49765 DATACLUB-SE European Union 25->55 75 System process connects to network (likely due to code injection or exploit) 25->75 77 Wscript called in batch mode (surpress errors) 25->77 38 wscript.exe 25->38         started        57 192.168.2.1 unknown unknown 33->57 file9 signatures10 process11 dnsIp12 59 javaautorun.duia.ro 35->59 61 javaautorun.duia.ro 38->61 79 System process connects to network (likely due to code injection or exploit) 38->79 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/085914ae6981487ee2ad184426717a2707df75e15e6b8cf48e5c2ff0186edcbb/
Threat name:
Script-JS.Trojan.Vjw0rm
Create hunting rule
Status:
Malicious
First seen:
2022-09-29 09:56:06 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbmrjltjqfeh5yvndbccm4l2e4d565pblzvyz5eolqx7agdo3s5q._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:vjw0rm persistence trojan worm
Link:
https://tria.ge/reports/220929-lycabsadc3/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Vjw0rm
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/085914ae6981/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/085914ae6981487ee2ad184426717a2707df75e15e6b8cf48e5c2ff0186edcbb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Vjw0rm

Java Script (JS) js 085914ae6981487ee2ad184426717a2707df75e15e6b8cf48e5c2ff0186edcbb

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments