Extracted

• • Target
    1f3ddbcaf256d060f62747541fcfb6b3964a03617fd090f3b3a19085d80d16f2.vbs
  • Size 3.2MB
  • SHA256 1f3ddbcaf256d060f62747541fcfb6b3964a03617fd090f3b3a19085d80d16f2
  • MD5 c885cf6ab4a109e3fa3cb75748cc0614
  • SHA1 24e11f1fdac6a84453276bfb94e9bccda4bc65a6
  • SHA512 c7843871c1d0fc92a492808bb54ee6d1773c30a6bbc56d9ccb0cee94b78b5ab0c3f40b422434d731a5cc4dc1ba052ce6c87d432b68f9a3e13d70c84f3ed34571
  • SSDEEP 24576:mPTTAqFJ6GuIRnsFRu3pPBLBVWAvDweZ3voVZGH4w2nb+3Szjy1O/SceDnCDoZ6g:0
  • TLSH
    T190F56014358A4119A13AA743F6F30461F83FA38D793AD92A2391E79C671B48B617F3CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistencetrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2