Extracted

• • Target
    NOTIFICACION_2_3D8AA2.vbs
  • Size 2.8MB
  • SHA256 54289be2a38b8cdce25dfdf92dcd09919ac5b78758fc41626406a3431348a826
  • MD5 c434865441799c57a64ba65cbe170803
  • SHA1 cb0e4af7858c21c0fe5ee994df9937fcf626b437
  • SHA512 4eac6c77f41bbc596ba6478444019af6a333b77c6c3de0658f66cab23ac926c7dea495db7eeeaa23376f799847ad9f8725b11452b1abdfefae4d4aa469f2bbfa
  • SSDEEP 24576:XYCSYo12CYmlcGD+naor/9wO02TeC0iE2xMFJAukrjJMiAyzpaB4B7J/c11wsPxT:e
  • TLSH
    T157D54BB845CA61322D75E002F8F7AC0190BB2B6F59389B49B1D1838D6B37689655F3CF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistenceprivilege_escalationtrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2