🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81061c078ee3a05adab2bc0a001e4bb3fd61b48dfb91af1a3de114806f012a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81061c078ee3a05adab2bc0a001e4bb3fd61b48dfb91af1a3de114806f012a2c
SHA3-384 hash: 5692fe194b7472fa75274a7d2e79648e6d1fd44ae69e518a9612fbd85c7c90b6a72fab328aa04a57c136ab83d40eff75
SHA1 hash: 6a96c8376b036428e7fa6df6d2cbee855afee2ef
MD5 hash: 8b8f2549bbebd12bb6e8360fab076d23
humanhash: asparagus-east-lion-cardinal
File name:invoice-041.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:31'240 bytes
First seen:2022-10-29 05:11:47 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:yUz+Bbpd+RNmrwMoVJpbJF/S2Iaf9fg1Q7Bp7zMn8sK:yl+YVoVJpbj/SNaf9LBp7zMn8sK
TLSH T16FE28EC45F45DF96E78C3D869C9C2D592338AED3410EA80FE192B68878D2843D90BBDD
Reporter abuse_ch
Tags:js vjw0rm

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://wordz54.duckdns.org:9010/Vre https://threatfox.abuse.ch/ioc/952613/

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Generic-P.867.26640.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm evasive obfuscated
Link:
https://www.filescan.io/uploads/635cb62458409ff7bc0c378e/reports/8f667f4b-a420-43d7-becf-04146a83ab16/overview
Result
Threat name:
VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1100775
Signature
Antivirus detection for URL or domain
Drops script or batch files to the startup folder
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for domain / URL
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: VjW0rm
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Wscript called in batch mode (surpress errors)
Yara detected VjW0rm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 733436 Sample: invoice-041.js Startdate: 29/10/2022 Architecture: WINDOWS Score: 100 46 Multi AV Scanner detection for domain / URL 2->46 48 Antivirus detection for URL or domain 2->48 50 Yara detected VjW0rm 2->50 52 4 other signatures 2->52 6 wscript.exe 2 17 2->6         started        11 wscript.exe 13 2->11         started        13 wscript.exe 13 2->13         started        15 2 other processes 2->15 process3 dnsIp4 40 wordz54.duckdns.org 107.182.129.16, 49685, 49687, 49688 META-ASUS Reserved 6->40 42 192.168.2.1 unknown unknown 6->42 30 C:\Users\...\invoice-041.js:Zone.Identifier, ASCII 6->30 dropped 32 C:\Users\user\AppData\...\invoice-041.js, ASCII 6->32 dropped 34 C:\Users\user\AppData\Roaming\WUFNyxGYUh.js, ASCII 6->34 dropped 36 2 other malicious files 6->36 dropped 56 System process connects to network (likely due to code injection or exploit) 6->56 58 JScript performs obfuscated calls to suspicious functions 6->58 60 Drops script or batch files to the startup folder 6->60 62 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 6->62 17 wscript.exe 13 6->17         started        64 Wscript called in batch mode (surpress errors) 11->64 21 wscript.exe 11->21         started        24 wscript.exe 13->24         started        44 javaautorun.duia.ro 15->44 26 wscript.exe 15->26         started        file5 signatures6 process7 dnsIp8 38 javaautorun.duia.ro 41.217.25.2, 5465 SpectranetNG Nigeria 17->38 28 C:\Users\user\AppData\...\WUFNyxGYUh.js, ASCII 17->28 dropped 54 System process connects to network (likely due to code injection or exploit) 21->54 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81061c078ee3a05adab2bc0a001e4bb3fd61b48dfb91af1a3de114806f012a2c/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-10-29 05:12:06 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 41 (14.63%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qedbyb4o4oqfvwvsxqfaahslwp6wdnen7oi26gr54ekia3ybfiwa._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:vjw0rm persistence trojan worm
Link:
https://tria.ge/reports/221029-fvv1dacch2/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Drops startup file
Blocklisted process makes network request
Vjw0rm
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/81061c078ee3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/81061c078ee3a05adab2bc0a001e4bb3fd61b48dfb91af1a3de114806f012a2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments