Extracted

• • Target
    50057f61c5b636890bc84c5ec4b7ccc8f2bf2dc40da5e3d61d1c93f5748e1f69.vbs
  • Size 3.3MB
  • SHA256 50057f61c5b636890bc84c5ec4b7ccc8f2bf2dc40da5e3d61d1c93f5748e1f69
  • MD5 976d861a6149b41e560b867b5e5883d4
  • SHA1 d95fc29c51a3b9e82a634522ab6ba59b9df67dcc
  • SHA512 b4c167181445e470722c91b1c5555e5f3205db3c7b75c27cf6120ba4ba36670262b0c47ddbef5592003248dea42379140dda86d0c4acddc2fba46de0e23c4f0e
  • SSDEEP 24576:xeD7x61ZqWO4hn8VRunZvhLxVWQfDAepX/Y1J2nIgGHL+3CjjSFuPCsuDHyjIZqn:q
  • TLSH
    T1FCF5393D6D04A11293F3E902D05BA48BFA67034F59705A0A23939785A79750BBBEF3CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvjw0rmpersistencetrojanworm

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2