🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 12


Intelligence 12 IOCs 2 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3
SHA3-384 hash: ead1aa16f3bfa1eb6fa9fcb8f228684510d31822f66788f057082a1b53b64b1904b3198d03c217733890231d81f0ce5b
SHA1 hash: 27684124da4ddfcb5e3f0a9be0a902c4535c05b5
MD5 hash: 1acd976f0876c86c32fc1ff6bf6044c2
humanhash: avocado-river-mango-island
File name:numx.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:938'820 bytes
First seen:2025-08-19 05:50:08 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:TL7el/8jj6ALeKP5CBiDfcWLmbnKtadm2lsL1hsxC/E7YgWf4qfRKHYJxHaRryd0:fg/CYBiDUhm2lFMs7OfLta7HjFw4n
TLSH T1051532AC6FA8947CF0F52503CD880ED85BBE6F50D9C134CDA45128AB79AFE258D8D11E
Magika javascript
Reporter abuse_ch
Tags:js vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
46.246.14.5:2703

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
46.246.14.5:2703 https://threatfox.abuse.ch/ioc/1571152/
46.246.14.5:7044 https://threatfox.abuse.ch/ioc/1571153/

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a410c28fd55a79c52925c3
Tags:
autorun houdini dunihi worm
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 cmd evasive explorer lolbin macros obfuscated obfuscated persistence wscript
Link:
https://www.filescan.io/uploads/68a410c9419c816a6e8b79f9/reports/d8e75692-583f-4210-a50a-dd841847dd42/overview
Verdict:
Malicious
Labled as:
GT:JS.Divergent.3.88C2B665;GT:JS.Divergent.3
Link:
https://www.hybrid-analysis.com/sample/dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3
Result
Threat name:
WSHRat, AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1759920
Signature
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected WSHRat
Drops script or batch files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Yara detected AsyncRAT
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1759920 Sample: numx.js Startdate: 19/08/2025 Architecture: WINDOWS Score: 100 65 zoo33.myddns.rocks 2->65 67 umar33myddns.rocks 2->67 69 9 other IPs or domains 2->69 77 Sigma detected: Register Wscript In Run Key 2->77 79 Suricata IDS alerts for network traffic 2->79 81 Found malware configuration 2->81 83 17 other signatures 2->83 10 wscript.exe 4 3 2->10         started        14 wscript.exe 2->14         started        16 wscript.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 file5 55 C:\Users\user\AppData\Local\Temp\svchost.js, ASCII 10->55 dropped 57 C:\Users\user\AppData\Local\Temp\audiodg.js, ASCII 10->57 dropped 87 Benign windows process drops PE files 10->87 89 Detected WSHRat 10->89 91 JScript performs obfuscated calls to suspicious functions 10->91 97 3 other signatures 10->97 20 wscript.exe 2 10->20         started        24 wscript.exe 3 2 10->24         started        93 Wscript called in batch mode (surpress errors) 14->93 26 wscript.exe 14->26         started        95 System process connects to network (likely due to code injection or exploit) 16->95 signatures6 process7 file8 51 C:\Users\user\AppData\Local\TempbehaviorgraphGZ.exe, PE32 20->51 dropped 85 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->85 28 GGZ.exe 1 6 20->28         started        53 C:\Users\user\AppData\Local\Temp\excel.xls, Composite 24->53 dropped 32 wscript.exe 24->32         started        34 EXCEL.EXE 117 59 24->34         started        signatures9 process10 dnsIp11 59 C:\Users\user\AppData\...\Windows Audio.exe, PE32 28->59 dropped 99 Antivirus detection for dropped file 28->99 101 Multi AV Scanner detection for dropped file 28->101 37 cmd.exe 28->37         started        61 C:\Users\user\AppData\Roaming\svchost.js, ASCII 32->61 dropped 63 C:\Users\user\AppData\Roaming\...\svchost.js, ASCII 32->63 dropped 103 Creates multiple autostart registry keys 32->103 105 Windows Scripting host queries suspicious COM object (likely to drop second stage) 32->105 107 Wscript called in batch mode (surpress errors) 32->107 39 wscript.exe 32->39         started        71 s-part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49738, 49740 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 34->71 42 splwow64.exe 34->42         started        file12 signatures13 process14 dnsIp15 44 Windows Audio.exe 37->44         started        47 conhost.exe 37->47         started        49 timeout.exe 37->49         started        73 chongmei33.publicvm.com 46.246.14.5, 2703, 49692, 49700 PORTLANEwwwportlanecomSE Sweden 39->73 process16 dnsIp17 75 umar33myddns.rocks 34.41.139.193, 49713, 49716, 49719 ATGS-MMD-ASUS United States 44->75
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3
Threat name:
Script-JS.Trojan.Divergent
Create hunting rule
Status:
Malicious
First seen:
2025-08-13 11:50:41 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 36 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3whomrxhvksbldw74zmcwp6krdjnpq4uqfakdmerqsnl5zkod3rq._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default-aug 25-11 defense_evasion discovery execution persistence rat
Link:
https://tria.ge/reports/250819-gj25zs1tb1/
Behaviour
Delays execution with timeout.exe
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Modifies trusted root certificate store through registry
Async RAT payload
AsyncRat
Asyncrat family
Malware Config
C2 Extraction:
jamesrockky.ydns.eu:2703
jamesrockky.ydns.eu:5670
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:5670
umar33myddns.rocks:2703
umar33myddns.rocks:5670
zoo33.myddns.rocks:2703
zoo33.myddns.rocks:5670
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dd8ee646e7aa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vjw0rm

Java Script (JS) js dd8ee646e7aaa4158edfe6582b3fca88d2d7c3948140a1b091849abee54e1ee3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3606580/
  
Delivery method
Distributed via web download

Comments