🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f96db19d19432e5984547e6c4e006ec86e6842f752ebaee0cd526a4aa1de5900. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f96db19d19432e5984547e6c4e006ec86e6842f752ebaee0cd526a4aa1de5900
SHA3-384 hash: edb71965dfe3f951ec36a44d8eeba69fc2b82d958f6622b30ed25304a89e7ec3b8817e4eb5546902bb898dc2d104c400
SHA1 hash: b7f978d5ec9afd2c81b6e77cb609ef107c63d558
MD5 hash: 3fd454ead642e09fa893849cf84d9767
humanhash: muppet-colorado-fillet-network
File name:eReceipt.js
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:17'315 bytes
First seen:2022-06-27 12:03:55 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:RVO4zxN9iTfJ9Rqn7LX9o9i45QJUeVT/d6CLWDXP9PNBIX8vdUKSEkdd:fVq/c1SQxdLLkGSdFSPd
TLSH T170729F9A5E127FF5BF4019800DFEFD487F789297E002B06E6573AA4441F55622E2F28D
Reporter abuse_ch
Tags:js vjw0rm


Avatar
abuse_ch
Vjw0rm C2:
http://zeegod.duckdns.org:9004/Vre

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://zeegod.duckdns.org:9004/Vre https://threatfox.abuse.ch/ioc/729456/

Intelligence

File Origin
# of uploads :
1
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive obfuscated schtasks wscript
Link:
https://www.filescan.io/uploads/62b99cd078c72835189646fe/reports/cff6a631-9a39-4571-8e89-52d5d67238de/overview
Result
Threat name:
VjW0rm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1020403
Signature
Antivirus detection for URL or domain
Creates multiple autostart registry keys
Drops script or batch files to the startup folder
JavaScript source code contains call to eval containing suspicious API calls
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential obfuscated javascript found
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Wscript called in batch mode (surpress errors)
Yara detected VjW0rm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 652895 Sample: eReceipt.js Startdate: 27/06/2022 Architecture: WINDOWS Score: 100 61 Snort IDS alert for network traffic 2->61 63 Multi AV Scanner detection for domain / URL 2->63 65 Antivirus detection for URL or domain 2->65 67 8 other signatures 2->67 7 wscript.exe 2 17 2->7         started        12 wscript.exe 2->12         started        14 wscript.exe 13 2->14         started        16 2 other processes 2->16 process3 dnsIp4 57 zeegod.duckdns.org 212.193.30.129, 49750, 49762, 49765 SPD-NETTR Russian Federation 7->57 47 C:\Users\user\eReceipt.js:Zone.Identifier, ASCII 7->47 dropped 49 C:\Users\user\eReceipt.js, ASCII 7->49 dropped 51 C:\Users\user\AppData\Roaming\tSeGAHHFWS.js, ASCII 7->51 dropped 53 2 other malicious files 7->53 dropped 73 System process connects to network (likely due to code injection or exploit) 7->73 75 JScript performs obfuscated calls to suspicious functions 7->75 77 Drops script or batch files to the startup folder 7->77 81 3 other signatures 7->81 18 wscript.exe 1 13 7->18         started        23 schtasks.exe 1 7->23         started        79 Wscript called in batch mode (surpress errors) 12->79 25 wscript.exe 12->25         started        27 schtasks.exe 1 12->27         started        29 wscript.exe 14->29         started        31 schtasks.exe 1 14->31         started        59 franmhort.duia.ro 16->59 33 wscript.exe 16->33         started        35 schtasks.exe 1 16->35         started        file5 signatures6 process7 dnsIp8 55 franmhort.duia.ro 91.192.100.8, 49749, 49763, 49764 AS-SOFTPLUSCH Switzerland 18->55 45 C:\Users\user\AppData\...\tSeGAHHFWS.js, ASCII 18->45 dropped 69 Creates multiple autostart registry keys 18->69 37 conhost.exe 23->37         started        71 System process connects to network (likely due to code injection or exploit) 25->71 39 conhost.exe 27->39         started        41 conhost.exe 31->41         started        43 conhost.exe 35->43         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f96db19d19432e5984547e6c4e006ec86e6842f752ebaee0cd526a4aa1de5900/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2022-06-27 12:04:05 UTC
File Type:
Text (JavaScript)
AV detection:
8 of 41 (19.51%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fw3dhizimxftbcupzwe4adozbxgqqxxklv25ygnkjvevio6leaa._file
Result
Malware family:
vjw0rm
Create hunting rule
Score:
  10/10
Tags:
family:vjw0rm persistence trojan worm
Link:
https://tria.ge/reports/220627-n8k2bscgg4/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Vjw0rm
Malware Config
C2 Extraction:
http://zeegod.duckdns.org:9004
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/f96db19d19432e5984547e6c4e006ec86e6842f752ebaee0cd526a4aa1de5900

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments