MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ae6589d067580a09ee6cc0c8ee067c4ea83769297141b796f6bf42e9f6d3fdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 5


Intelligence 5 IOCs 6 YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ae6589d067580a09ee6cc0c8ee067c4ea83769297141b796f6bf42e9f6d3fdd
SHA3-384 hash: 94bb9307d8c93953149d65cbabafd87fec9a7088ef5d9c1c5d19b24ca10544d498051ba59e6f42f14fb4e0482d653801
SHA1 hash: 1b97e8fab8c75de63b057f7c6046d617d4fd01b2
MD5 hash: ac46457e480306c3be0df227c2b329a2
humanhash: artist-lake-juliet-solar
File name:Recibo de pago.r00
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:314'473 bytes
First seen:2022-09-23 07:47:40 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:cxjqyt26uKdSUNkPd+IJe1hCHyzS2ATzjBVORtr6y4iS+rAUAG:cx6x8NkPgYSEnBVOD6y4H+rADG
TLSH T13D64234AC613CBFEB320EEAB757A045357C4DBC8ABF786268273A7A470C54ED9C40605
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter 0xToxin
Tags:AgentTesla r00 vjw0rm wshrat

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://goods.camdvr.org:2888/is-ready https://threatfox.abuse.ch/ioc/850897/
37.0.14.211:2888 https://threatfox.abuse.ch/ioc/850898/
http://goods.camdvr.org:2888/moz-sdk https://threatfox.abuse.ch/ioc/851154/
http://goods.camdvr.org:2888/ie https://threatfox.abuse.ch/ioc/851155/
http://goods.camdvr.org:2888/give-me-chpv https://threatfox.abuse.ch/ioc/851156/
http://goods.camdvr.org:2888/give-me-ffpv https://threatfox.abuse.ch/ioc/851157/

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Recibo de pago.js
File size:647'756 bytes
SHA256 hash: 0c080c6425c6475e91fd8041db1609dc45c2f0e3e4073626c56f782685fb6621
MD5 hash: 7d685c3a21c226778a183ced19fcac28
MIME type:text/plain
Signature Vjw0rm
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ae6589d067580a09ee6cc0c8ee067c4ea83769297141b796f6bf42e9f6d3fdd/
Threat name:
Script-JS.Trojan.Vjw0rm
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 07:48:09 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
14 of 39 (35.90%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pltfrhigowakbhxgzqgi5ydhytvig5uss4kbw6lpnp2c5h3nh7oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/7ae6589d067580a09ee6cc0c8ee067c4ea83769297141b796f6bf42e9f6d3fdd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_Double_Base64_Encoded_Executable
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Vjw0rm

r00 7ae6589d067580a09ee6cc0c8ee067c4ea83769297141b796f6bf42e9f6d3fdd

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments


Avatar
0xToxin commented on 2022-09-23 07:56:51 UTC

contains:
https://bazaar.abuse.ch/sample/0c080c6425c6475e91fd8041db1609dc45c2f0e3e4073626c56f782685fb6621