🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 287fb2e478533883d3f5b4bd099aa8b6bcd58598dedd5f00d53413b94157a262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 287fb2e478533883d3f5b4bd099aa8b6bcd58598dedd5f00d53413b94157a262
SHA3-384 hash: b63d7416512eec298f386a79340982874ed79141e6f6c1bcb4611d9e4b2b9862a9e7e0af164e26627bcb00608bc3cf41
SHA1 hash: d7152d81db6dead04546f13c2b8100ab7c1763f7
MD5 hash: cf4ee8581d69dfe87536fb186c19a3de
humanhash: monkey-ohio-cola-nitrogen
File name:NSC0551923.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:371'337 bytes
First seen:2022-05-19 07:46:30 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:M1jwUaDGTBpFQnK7zzL7Q3zHXU+67ZWPeaHc/gxmWcXoq/GzbDv0s5pYvWJdbLuo:M10UaDGTBpFQnOezHnEWPe4c/8mVokGZ
TLSH T14984C0308B80AB5A9A958817D07D1E4E56F31B6AE423F3CC729F35072F7EE4DCA16581
Reporter abuse_ch
Tags:js vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
http://travcharles.duia.ro:5098/Vre

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://travcharles.duia.ro:5098/Vre https://threatfox.abuse.ch/ioc/601823/

Intelligence

File Origin
# of uploads :
1
# of downloads :
386
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Vajawom.23509.30288.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive obfuscated packed wscript wscript.exe
Link:
https://www.filescan.io/uploads/6285f63325bc5675108ddbfb/reports/6f66614b-fa17-459e-8f1b-b52b7cbdd0dd/overview
Result
Threat name:
FormBook, VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/997458
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Drops script or batch files to the startup folder
Found malware configuration
JavaScript source code contains call to eval containing suspicious API calls
JavaScript source code contains functionality to generate code involving a shell, file or stream
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Performs DNS queries to domains with low reputation
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Wscript called in batch mode (surpress errors)
Yara detected FormBook
Yara detected VjW0rm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 629954 Sample: NSC0551923.js Startdate: 19/05/2022 Architecture: WINDOWS Score: 100 68 Snort IDS alert for network traffic 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 8 other signatures 2->74 10 wscript.exe 3 2->10         started        process3 file4 48 C:\Users\user\AppData\Local\Temp\bin.exe, PE32 10->48 dropped 50 C:\Users\user\AppData\Roaming\MYpPAmfqZr.js, ASCII 10->50 dropped 94 System process connects to network (likely due to code injection or exploit) 10->94 96 Benign windows process drops PE files 10->96 98 Drops script or batch files to the startup folder 10->98 100 2 other signatures 10->100 14 bin.exe 10->14         started        17 wscript.exe 2 13 10->17         started        signatures5 process6 dnsIp7 102 Antivirus detection for dropped file 14->102 104 Multi AV Scanner detection for dropped file 14->104 106 Machine Learning detection for dropped file 14->106 108 5 other signatures 14->108 21 explorer.exe 1 14->21 injected 52 travcharles.duia.ro 45.133.174.169, 49758, 49770, 49773 ASBLANKPROXIESGB United Kingdom 17->52 46 C:\Users\user\AppData\...\MYpPAmfqZr.js, ASCII 17->46 dropped file8 signatures9 process10 signatures11 80 System process connects to network (likely due to code injection or exploit) 21->80 82 Performs DNS queries to domains with low reputation 21->82 24 wlanext.exe 1 12 21->24         started        28 wscript.exe 12 21->28         started        30 wscript.exe 12 21->30         started        32 wscript.exe 21->32         started        process12 dnsIp13 60 www.o7oiwlp.xyz 24->60 84 Tries to steal Mail credentials (via file / registry access) 24->84 86 Performs DNS queries to domains with low reputation 24->86 88 Tries to harvest and steal browser information (history, passwords, etc) 24->88 92 3 other signatures 24->92 34 explorer.exe 5 161 24->34         started        38 cmd.exe 24->38         started        40 cmd.exe 1 24->40         started        62 travcharles.duia.ro 28->62 90 System process connects to network (likely due to code injection or exploit) 28->90 64 travcharles.duia.ro 30->64 66 travcharles.duia.ro 32->66 signatures14 process15 dnsIp16 54 www.tentanguang.online 185.27.134.149, 49872, 49873, 49874 WILDCARD-ASWildcardUKLimitedGB United Kingdom 34->54 56 www.topings33.com 162.0.230.89, 49830, 80 NAMECHEAP-NETUS Canada 34->56 58 9 other IPs or domains 34->58 76 System process connects to network (likely due to code injection or exploit) 34->76 78 Tries to harvest and steal browser information (history, passwords, etc) 38->78 42 conhost.exe 38->42         started        44 conhost.exe 40->44         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/287fb2e478533883d3f5b4bd099aa8b6bcd58598dedd5f00d53413b94157a262/
Threat name:
Script.Dropper.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-05-19 07:40:07 UTC
File Type:
Text (JavaScript)
AV detection:
4 of 41 (9.76%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fb73fzdykm4ihu7vws6qtgviw26nlbmy33ov6agvgqj3sqkxujra._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:vjw0rm family:xloader campaign:np8s loader persistence rat spyware stealer suricata trojan worm
Link:
https://tria.ge/reports/220519-jmhxmacec5/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Reads user/profile data of web browsers
Adds policy Run key to start application
Blocklisted process makes network request
Executes dropped EXE
Xloader Payload
Formbook
Vjw0rm
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Malware Config
C2 Extraction:
http://travcharles.duia.ro:5098
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/287fb2e478533883d3f5b4bd099aa8b6bcd58598dedd5f00d53413b94157a262

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments