🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85dfef0c1b65ee9eb213ea830e0a78d471872e947e1924e90365d29cdeb64c10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85dfef0c1b65ee9eb213ea830e0a78d471872e947e1924e90365d29cdeb64c10
SHA3-384 hash: 4af3733bd47f76049d07539bcce238efea236d25bc7a4f00d102f8a24185c701b5e3ccc3623bbdb6fcb47e03f44000cc
SHA1 hash: a91dbfdf6756b91155deb9bb70b246a93305b1b1
MD5 hash: 1ee114916e52a6c572908bc5e6cfcfd0
humanhash: quiet-hydrogen-undress-burger
File name:85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:279'040 bytes
First seen:2022-08-19 15:05:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 596baa240d06336d7a812c3e19d7d6ac (1 x Vjw0rm)
ssdeep 6144:b7v2qpIYih+xyrQrVmdzBlZlKLcmPm93nskQ4X+Voj4K:b73yWmdzBlZlK/PmdskFfj4K
Threatray 1 similar samples on MalwareBazaar
TLSH T14C548D207BD1C873C6A2347609A5D7B976BEA5305B3282C777941F3E9E306D25A3834B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe vjw0rm


Avatar
abuse_ch
None C2:
204.95.99.109:82

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
204.95.99.109:82 https://threatfox.abuse.ch/ioc/844096/

Intelligence

File Origin
# of uploads :
1
# of downloads :
335
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
wshrat
Create hunting rule
ID:
1
File name:
85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe
Verdict:
Malicious activity
Analysis date:
2022-08-19 15:08:03 UTC
Tags:
trojan wshrat
Link:
https://app.any.run/tasks/b4e15fb4-9f5b-4cad-bf39-995a4f3df9fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/299787/
Detection(s):
Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL
Create hunting rule

Vbs.Malware.Hworm-6735698-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Query of malicious DNS domain
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/29505/overview
Behaviour
MalwareBazaar
SystemUptime
CursorPosition
MeasuringTime
CheckScreenResolution
CPUID_Instruction
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
hworm packed
Link:
https://www.filescan.io/uploads/62ffa75880cda5aeee17d15a/reports/6c3a8398-e3bd-4965-8f3b-94fbd291d88b/overview
Malware family:
Jenxcus
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5fed3118-dd3a-43ea-a26e-289944d646a6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1054472
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Snort IDS alert for network traffic
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 686989 Sample: 85DFEF0C1B65EE9EB213EA830E0... Startdate: 19/08/2022 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic 2->37 39 Antivirus / Scanner detection for submitted sample 2->39 41 Multi AV Scanner detection for dropped file 2->41 43 4 other signatures 2->43 6 85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe 4 5 2->6         started        10 85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe 9 2->10         started        13 85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe 2->13         started        15 5 other processes 2->15 process3 dnsIp4 23 85DFEF0C1B65EE9EB2...D471872E947E192.exe, PE32 6->23 dropped 25 85DFEF0C1B65EE9EB2...D471872E947E192.exe, PE32 6->25 dropped 27 85DFEF0C1B65EE9EB2...exe:Zone.Identifier, ASCII 6->27 dropped 29 85DFEF0C1B65EE9EB2...exe:Zone.Identifier, ASCII 6->29 dropped 53 Creates autostart registry keys with suspicious names 6->53 55 Creates multiple autostart registry keys 6->55 57 Drops PE files to the startup folder 6->57 17 85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe 3 9 6->17         started        33 rk2013controler.no-ip.org 10->33 35 192.168.2.1 unknown unknown 10->35 21 85DFEF0C1B65EE9EB213EA830E0A78D471872E947E192.exe 13->21         started        file5 signatures6 process7 dnsIp8 31 rk2013controler.no-ip.org 204.95.99.109, 49706, 49707, 49716 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->31 45 Antivirus detection for dropped file 17->45 47 Multi AV Scanner detection for dropped file 17->47 49 Machine Learning detection for dropped file 17->49 51 3 other signatures 17->51 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85dfef0c1b65ee9eb213ea830e0a78d471872e947e1924e90365d29cdeb64c10/
Threat name:
Win32.Worm.Dinihou
Create hunting rule
Status:
Malicious
First seen:
2022-08-18 23:24:00 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxp66da3mxxj5mqt5kbq4cty2ryyoluupymsj2idmxjjzxvwjqia._file
Verdict:
malicious
Similar samples:
2335a27e989b6591f5c7207a39fd25e2de184e0d6ba5170bf6f609105b72d03e
Vjw0rm
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/220819-sgqvqaheg4/
Behaviour
Enumerates physical storage devices
Adds Run key to start application
Drops startup file
Unpacked files
SH256 hash:
85dfef0c1b65ee9eb213ea830e0a78d471872e947e1924e90365d29cdeb64c10
MD5 hash:
1ee114916e52a6c572908bc5e6cfcfd0
SHA1 hash:
a91dbfdf6756b91155deb9bb70b246a93305b1b1
Link:
https://www.unpac.me/results/e7ead9fb-acbc-44d2-ac1e-295df636452a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85dfef0c1b65ee9eb213ea830e0a78d471872e947e1924e90365d29cdeb64c10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MyWScript_CompiledScript
Create hunting rule
Author:Florian Roth
Description:Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)
Reference:Internal Research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SUSP_MyWScript_RID2C4D
Create hunting rule
Author:Florian Roth
Description:Detects files generated with Script2Exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/299787/

Comments