vjw0rm | a43edeaf78db1dc699e644a6eeab33d67441b862c45b9351a8cdab7590ba730d

General

Target
2026-07-03_f99cc7f56f7cd54c857c3debb07aaf3a_agent-tesla_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 9.5MB
Sample260703-srycjsgx5m
SHA256 a43edeaf78db1dc699e644a6eeab33d67441b862c45b9351a8cdab7590ba730d
MD5 f99cc7f56f7cd54c857c3debb07aaf3a
SHA1 e28a099dfbbc9d9c4229510aa34a093bfebe5931
SHA512 36d9a65860d7f21bc472a5333f80922c7f48e0f750c53c2193a1e8f010df09b7ff5ac1223ccc404bcd657d0ad60f0fde68bde25042e624f57fbae99326dee405
SSDEEP 196608:a6z5K+z79L2u079YfzP/LkMdi9nGvAFHX9f1jF9FF9:am5K+o9xiP/LLHvENtB9b9
TLSH
T15BA61242738EC363EFA215B38976B36149787C7913E649DF23F7183DE4B05905A3A622
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-03_f99cc7f56f7cd54c857c3debb07aaf3a_agent-tesla_amadey_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 9.5MB
- SHA256 a43edeaf78db1dc699e644a6eeab33d67441b862c45b9351a8cdab7590ba730d
- MD5 f99cc7f56f7cd54c857c3debb07aaf3a
- SHA1 e28a099dfbbc9d9c4229510aa34a093bfebe5931
- SHA512 36d9a65860d7f21bc472a5333f80922c7f48e0f750c53c2193a1e8f010df09b7ff5ac1223ccc404bcd657d0ad60f0fde68bde25042e624f57fbae99326dee405
- SSDEEP 196608:a6z5K+z79L2u079YfzP/LkMdi9nGvAFHX9f1jF9FF9:am5K+o9xiP/LLHvENtB9b9
- TLSH
  T15BA61242738EC363EFA215B38976B36149787C7913E649DF23F7183DE4B05905A3A622
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution vjw0rm installer persistence ransomware spyware stealer trojan worm
- Family: Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Detects executables packed with Dotfuscator
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2