🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc
SHA3-384 hash: 729acbd40cde445f84e310cbef0de526583711c97848741210d568b892c48727251ff3032a4bf62dc6534756ed1f9bde
SHA1 hash: 1530b6e0a924738a8786065c55bf8f3089177bef
MD5 hash: 1cbd83f1bf2a1b9644a771224fee3f6d
humanhash: quiet-asparagus-neptune-may
File name:N504152014.vbs
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:222 bytes
First seen:2021-07-22 23:26:01 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6:wSxWPNeFHTHHa6XX++tpP4rDJAbVhB8pQC:wqHTa6n++tkITTC
TLSH T183D0A73989014C465A506DF51AEEE606F27251F600E0A834E647D89C135A85D8C39092
Reporter abuse_ch
Tags:vbs vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
http://185.81.157.187:9093/Vre

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.81.157.187:9093/Vre https://threatfox.abuse.ch/ioc/162210/

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173450/
Detection(s):
SecuriteInfo.com.CL.Downloadergen247.1589.6349.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820459
Signature
Drops script or batch files to the startup folder
Obfuscated command line found
Sigma detected: Drops script at startup location
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious PowerShell Command Line
Sigma detected: WScript or CScript Dropper
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 452867 Sample: N504152014.vbs Startdate: 23/07/2021 Architecture: WINDOWS Score: 100 87 Yara detected Powershell download and execute 2->87 89 Sigma detected: Drops script at startup location 2->89 91 Sigma detected: Mshta Spawning Windows Shell 2->91 93 4 other signatures 2->93 13 wscript.exe 1 2->13         started        16 wscript.exe 2->16         started        process3 signatures4 103 VBScript performs obfuscated calls to suspicious functions 13->103 105 Wscript starts Powershell (via cmd or directly) 13->105 107 Very long command line found 13->107 109 Drops script or batch files to the startup folder 13->109 18 mshta.exe 25 13->18         started        22 powershell.exe 16->22         started        process5 dnsIp6 81 bit.ly 67.199.248.11, 443, 49717 GOOGLE-PRIVATE-CLOUDUS United States 18->81 95 Obfuscated command line found 18->95 24 powershell.exe 17 24 18->24         started        signatures7 process8 dnsIp9 85 185.81.157.24, 49718, 49724, 49730 INU-ASFR France 24->85 71 C:\Users\Public\test.ps1, ASCII 24->71 dropped 73 C:\Users\Public\run.ps1, ASCII 24->73 dropped 75 C:\Users\Public\alosh.ps1, ASCII 24->75 dropped 77 C:\Users\Public\Chrome.vbs, ASCII 24->77 dropped 28 wscript.exe 24->28         started        31 wscript.exe 24->31         started        34 conhost.exe 24->34         started        file10 process11 file12 99 Wscript starts Powershell (via cmd or directly) 28->99 36 powershell.exe 28->36         started        79 C:\Users\user\...\WindowsSystemUpdate.js, ASCII 31->79 dropped 101 Very long command line found 31->101 38 powershell.exe 31->38         started        signatures13 process14 dnsIp15 41 wscript.exe 36->41         started        44 conhost.exe 36->44         started        83 185.81.157.187, 49732, 49733, 9093 INU-ASFR France 38->83 46 conhost.exe 38->46         started        process16 signatures17 97 Wscript starts Powershell (via cmd or directly) 41->97 48 powershell.exe 41->48         started        50 powershell.exe 41->50         started        process18 process19 52 Dism.exe 48->52         started        55 conhost.exe 48->55         started        57 conhost.exe 50->57         started        file20 63 C:\Users\user\AppData\...\WimProvider.dll.mui, PE32 52->63 dropped 65 C:\Users\user\AppData\...\VhdProvider.dll.mui, PE32 52->65 dropped 67 C:\Users\user\...\UnattendProvider.dll.mui, PE32 52->67 dropped 69 49 other files (none is malicious) 52->69 dropped 59 DismHost.exe 52->59         started        61 conhost.exe 57->61         started        process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc/
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-07-22 23:27:03 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohyttvxlkqyfosl22sjhbswjbupnxqgw6aqb5bpcdsqpaxx3gc6a._file
Verdict:
unknown
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:vjw0rm trojan worm
Link:
https://tria.ge/reports/210722-g3ec3pndms/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
Vjw0rm
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/173450/

Comments