Extracted

• • Target
    99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515.vbs
  • Size 1.3MB
  • SHA256 99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515
  • MD5 cf9b70f279147cc1e66b87981ec33ad1
  • SHA1 b9ba55d518ad7c19ad95a68d287098099dea7f43
  • SHA512 a0dd6e3186f3da67a9c5e69ae1dafe1785335d07c18264038bc52de8d667ea6674207527fd2ce53a261897665b413aca8401a45c8c0e8643ff4fe1283bdefbba
  • SSDEEP 3072:gAsDWTHSnxrYgY9tJscvjMtL55gaiBRKfYRf1l8FN9ymojvB9RjhNjv0lSQK8kFa:grOchXh/QDe
  • TLSH
    T12B55FFB91F9818CBCCBA1345B127C061BE6FBE15C623B8EF5A1D4DD0254280698FE5ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistencetrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2