Extracted

• • Target
    3809c5b99a5da43070b1fa70b77756c72cc3b5cc1996edd080f078a9010d9784.vbs
  • Size 1.6MB
  • SHA256 3809c5b99a5da43070b1fa70b77756c72cc3b5cc1996edd080f078a9010d9784
  • MD5 65790bb5da8b5efe1f4767f63babdf90
  • SHA1 44f50ee52be4861ec6d0b9bf02e4c37a45d95c49
  • SHA512 71be4bcd6c68dfc765ae619c4a8b40fff8be0b81a9ad1a89ce51a280de303f67708aea824da5e30a7232aac4e95dcccd73d99fe9a7557b3acc68b03850734c53
  • SSDEEP 3072:DHqJkjeC/bT5lZsuzMK6HUIX4iyATedyocVJle0QJDICBhvi52z9j7Td4RXN7JLY:DXh
  • TLSH
    T1868560602D8A644EC15B5042E35ECE93B61A7D11731278B156BC4B37EE0F83DEA8F6E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistencetrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2