Extracted

• • Target
    c6186f60c2e75e21820d8d7297aff52f3f3d45d3dac18bf11873cc3dcf0c6dad.vbs
  • Size 1.7MB
  • SHA256 c6186f60c2e75e21820d8d7297aff52f3f3d45d3dac18bf11873cc3dcf0c6dad
  • MD5 206a154e89677650100712d5c10246fc
  • SHA1 9d671fea51f7dd46bc308607ada41f9bf1e398ee
  • SHA512 0943405b51e5b18bef6a3fbd3f907399630609633a3386758b90e6294ec4f599391632de7fc996fde54c6ae06f852544babff5680e7fd935bdbcf10c3158df26
  • SSDEEP 3072:ap8RXeNfKWZ1xHth/TyQoZR8PjfJaF92eM/5gNI6AfUEIjC6y01caSiZVtMkI4IZ:ap8emN7Nepbd7
  • TLSH
    T1E68570602D8A648EC11B5042E35ECE53B61A7D11731278B156BC4B37EE1F83DEA8F7A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistencetrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2