🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6d4d55f2df43c5d2a35a96b53ac0f949673a901ce8aeb41ed1144ecb7b3ba09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6d4d55f2df43c5d2a35a96b53ac0f949673a901ce8aeb41ed1144ecb7b3ba09
SHA3-384 hash: 121d240bc9307a24201469f7bdc1dd863602ca06b291f87de6ac96043a843cced111bbc5538331f59c3233af10581f28
SHA1 hash: a933a3f7da664089ab715ee06ca9fdf17d9ef318
MD5 hash: 8c577d950786e8262f22dd3c23ca8c07
humanhash: december-river-oklahoma-twenty
File name:ORDER SPECIFICATION.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:83'472 bytes
First seen:2022-06-20 07:37:40 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:zDVQKCPd7kXdFC8aC4iOjtOfn9YDWOOq/WLOFr8Tm34lfrHP3f3vr8fdKCXN:wU3CS3J9NTrfTA7
TLSH T169839ED0FA9031BED69650F719BF2A0E53B49103AA049445F265F6302FF5F88D627F2A
Reporter abuse_ch
Tags:js vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
http://franmhort.duia.ro:8152/Vre

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://franmhort.duia.ro:8152/Vre https://threatfox.abuse.ch/ioc/696909/

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Trojan.Cryxos.9324.8595.20874.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive obfuscated packed wscript
Link:
https://www.filescan.io/uploads/62b023dbdbe9c7c94971f36c/reports/a8690439-5d47-4659-8801-ae63870d7e82/overview
Result
Threat name:
NetWire, VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1016121
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Drops script or batch files to the startup folder
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Injects a PE file into a foreign processes
JavaScript source code contains call to eval containing suspicious API calls
JScript performs obfuscated calls to suspicious functions
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potential malicious VBS/JS script found (suspicious encoded strings)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected NetWire RAT
Yara detected VjW0rm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 648618 Sample: ORDER SPECIFICATION.js Startdate: 20/06/2022 Architecture: WINDOWS Score: 100 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for URL or domain 2->73 75 Antivirus detection for dropped file 2->75 77 11 other signatures 2->77 8 wscript.exe 16 2->8         started        13 wscript.exe 12 2->13         started        15 wscript.exe 12 2->15         started        17 wscript.exe 2->17         started        process3 dnsIp4 59 45.154.98.71, 49740, 80 LRH-ASNL Belgium 8->59 47 C:\Users\user\AppData\...\QB8Dp5m5pHF6fkB.exe, PE32 8->47 dropped 49 C:\Users\user\...\QB8Dp5m5pHF6fkB[1].exe, PE32 8->49 dropped 51 C:\Users\user\AppData\Roaming\SdORAbNrxc.js, ASCII 8->51 dropped 87 System process connects to network (likely due to code injection or exploit) 8->87 89 Benign windows process drops PE files 8->89 91 JScript performs obfuscated calls to suspicious functions 8->91 93 3 other signatures 8->93 19 QB8Dp5m5pHF6fkB.exe 6 8->19         started        23 wscript.exe 2 13 8->23         started        61 franmhort.duia.ro 13->61 63 franmhort.duia.ro 15->63 65 192.168.2.1 unknown unknown 15->65 67 franmhort.duia.ro 17->67 file5 signatures6 process7 dnsIp8 41 C:\Users\user\AppData\Roaming\HSzaYH.exe, PE32 19->41 dropped 43 C:\Users\user\AppData\Local\...\tmp9AE2.tmp, XML 19->43 dropped 79 Antivirus detection for dropped file 19->79 81 Machine Learning detection for dropped file 19->81 83 Uses schtasks.exe or at.exe to add and modify task schedules 19->83 85 3 other signatures 19->85 26 vbc.exe 19->26         started        31 vbc.exe 19->31         started        33 powershell.exe 19->33         started        35 schtasks.exe 19->35         started        57 franmhort.duia.ro 91.192.100.8, 49742, 49748, 49749 AS-SOFTPLUSCH Switzerland 23->57 45 C:\Users\user\AppData\...\SdORAbNrxc.js, ASCII 23->45 dropped file9 signatures10 process11 dnsIp12 69 netuwaya.servecounterstrike.com 91.193.75.135, 4734, 49772 DAVID_CRAIGGG Serbia 26->69 53 C:\Users\user\AppData\Roaming\...\sqlite3.dll, PE32 26->53 dropped 55 C:\Users\user\AppData\Local\...\LoginDataCopy, SQLite 26->55 dropped 95 Tries to steal Mail credentials (via file / registry access) 26->95 97 Tries to harvest and steal browser information (history, passwords, etc) 26->97 99 DLL side loading technique detected 26->99 101 Found evasive API chain (may stop execution after checking mutex) 31->101 103 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 31->103 37 conhost.exe 33->37         started        39 conhost.exe 35->39         started        file13 signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6d4d55f2df43c5d2a35a96b53ac0f949673a901ce8aeb41ed1144ecb7b3ba09/
Threat name:
Script-JS.Downloader.Nemucod
Create hunting rule
Status:
Malicious
First seen:
2022-06-20 07:38:06 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 26 (38.46%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23knkxzn6q6f2krvvfvvhlapsslhhkibz2fowqpncfcozn5txieq._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:netwire family:vjw0rm botnet persistence rat stealer trojan worm
Link:
https://tria.ge/reports/220620-jgc47adad7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
NetWire RAT payload
Netwire
Vjw0rm
Malware Config
C2 Extraction:
netuwaya.servecounterstrike.com:4734
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d6d4d55f2df4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/d6d4d55f2df43c5d2a35a96b53ac0f949673a901ce8aeb41ed1144ecb7b3ba09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments