MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85daaa8ff4820b98c0d1471ed68ab675f2fea97f4d6f6f48a951b4344b9c2b38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85daaa8ff4820b98c0d1471ed68ab675f2fea97f4d6f6f48a951b4344b9c2b38
SHA3-384 hash: aac8e248d715744848bc594d0056f122b706f34119070deb03a9eaeb509b997f9c11b014666f34c3d5d5adb0056eb56d
SHA1 hash: a9b312e682e43b28d28faf6b66c903ba12dfecf5
MD5 hash: b1d6eafab8240680ef96194944ce3801
humanhash: november-sweet-three-romeo
File name:New Price List For DStv&GOtv.pdf.jar
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:193'914 bytes
First seen:2022-01-18 11:27:04 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:jNfVpOsouwKQI5M7aHrj4gAlU7rqe6i5kIUKweUDZqZWo3WsC2q6W7rKxh:BbJdwKBKcr7dtr+hKi9Sq6WaD
TLSH T12D1423F35EDADD4FAB675CA4C5211821D1DC971B87104FA28BCED2BE18619BDEB90410
Reporter abuse_ch
Tags:jar vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
185.140.53.4:6300

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.140.53.4:6300 https://threatfox.abuse.ch/ioc/298407/

Intelligence

File Origin
# of uploads :
1
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
85daaa8ff4820b98c0d1471ed68ab675f2fea97f4d6f6f48a951b4344b9c2b38.zip
Verdict:
Malicious activity
Analysis date:
2022-01-18 16:26:58 UTC
Tags:
trojan strrat rat evasion
Link:
https://app.any.run/tasks/6443889d-baa9-4899-8eb8-09eb13d66b6c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/220103/
Detection(s):
SecuriteInfo.com.Java.Dropper.49.30527.21842.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
wscript.exe
Link:
https://www.filescan.io/uploads/61e6a40f0f8c757253c8342e/reports/a6bee522-1c72-4966-8a78-7da2a2b7b328/overview
Result
Threat name:
STRRAT VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/922327
Signature
Antivirus detection for URL or domain
Drops script or batch files to the startup folder
Exploit detected, runtime environment starts unknown processes
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Suspicious Shells Spawn by Java
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Yara detected VjW0rm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 554805 Sample: New Price List For DStv&GOt... Startdate: 18/01/2022 Architecture: WINDOWS Score: 100 41 sonatype.map.fastly.net 2->41 43 repo1.maven.org 2->43 45 github.com 2->45 61 Antivirus detection for URL or domain 2->61 63 Yara detected VjW0rm 2->63 65 Yara detected STRRAT 2->65 67 6 other signatures 2->67 9 cmd.exe 2 2->9         started        11 wscript.exe 12 2->11         started        15 wscript.exe 12 2->15         started        17 wscript.exe 12 2->17         started        signatures3 process4 dnsIp5 19 java.exe 6 9->19         started        22 conhost.exe 9->22         started        47 macjoe597.duia.ro 11->47 73 System process connects to network (likely due to code injection or exploit) 11->73 75 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 11->75 49 macjoe597.duia.ro 15->49 51 macjoe597.duia.ro 17->51 signatures6 process7 file8 37 C:\Users\user\_output.js, ASCII 19->37 dropped 24 wscript.exe 3 3 19->24         started        27 icacls.exe 1 19->27         started        process9 signatures10 69 Drops script or batch files to the startup folder 24->69 71 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 24->71 29 wscript.exe 2 13 24->29         started        33 javaw.exe 21 24->33         started        35 conhost.exe 27->35         started        process11 dnsIp12 53 macjoe597.duia.ro 91.193.75.133, 49763, 49770, 49775 DAVID_CRAIGGG Serbia 29->53 39 C:\Users\user\AppData\...\OJBcFWZNgk.js, ASCII 29->39 dropped 55 github.com 140.82.121.4, 443, 49764, 49773 GITHUBUS United States 33->55 57 sonatype.map.fastly.net 199.232.192.209, 443, 49765, 49766 FASTLYUS United States 33->57 59 2 other IPs or domains 33->59 file13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85daaa8ff4820b98c0d1471ed68ab675f2fea97f4d6f6f48a951b4344b9c2b38/
Threat name:
ByteCode-JAVA.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2022-01-18 11:28:10 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
9 of 43 (20.93%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxnkvd7uqifzrqgri4pnncvwoxzp5kl7jvxw6sfjkg2dis44fm4a._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:strrat family:vjw0rm collection persistence stealer trojan worm
Link:
https://tria.ge/reports/220118-nkgn1aahd4/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Program Files directory
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
STRRAT
Vjw0rm
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/85daaa8ff4820b98c0d1471ed68ab675f2fea97f4d6f6f48a951b4344b9c2b38

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/220103/

Comments