🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca65bd6a5fc3f9263908d87b4fd4dd70e1f1f83c67c3ea740132595a40dd6c52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 6


Intelligence 6 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca65bd6a5fc3f9263908d87b4fd4dd70e1f1f83c67c3ea740132595a40dd6c52
SHA3-384 hash: faaf10f6d2d2f8a053a5f4cf82b4e7a3943b3da7e29f46d38775b2c4efbacd21fc77f32da461e2c15bde5dfa2f9daa9b
SHA1 hash: 924a37a2d50d9c13378c67713071f6f9f7d439bc
MD5 hash: 4c58f749583af215176df06d6e92586b
humanhash: eight-one-video-moon
File name:#BS0932MTANS622.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:66'483 bytes
First seen:2021-11-15 16:31:30 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:rArdhrloFNvmcbJIsIAs+kYOPvL6zX0pn+mrGKRYOV7aWt3KNmEwJbnc0wO2MEo:rArdhJoFNvmcbJIsIAIYOPvL6zX0pn+8
TLSH T14E5383C133D5BC81124797B7372BB0E2E46A9C9871C5899EF514FC98F4A8926FBE0970
Reporter abuse_ch
Tags:js vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
http://13.92.159.78:6430/Vre

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://13.92.159.78:6430/Vre https://threatfox.abuse.ch/ioc/249203/

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61928b84a00afa9663a87c8b/reports/f69dd9e1-b840-437d-98c6-0c7b07789ab3/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca65bd6a5fc3f9263908d87b4fd4dd70e1f1f83c67c3ea740132595a40dd6c52/
Threat name:
Script-JS.Worm.Vjworm
Create hunting rule
Status:
Malicious
First seen:
2021-11-15 16:32:05 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zjs322s7yp4smoii3b5u7vg5odq7d6b4m7b6u5abgjmvuqg5nrja._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:vjw0rm persistence trojan worm
Link:
https://tria.ge/reports/211115-t1ykcafhfp/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Drops startup file
Blocklisted process makes network request
Vjw0rm
Malware Config
C2 Extraction:
http://13.92.159.78:6430
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca65bd6a5fc3f9263908d87b4fd4dd70e1f1f83c67c3ea740132595a40dd6c52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments