Loading malware…
Vjw0rm is a commodity JavaScript remote access trojan targeting Windows systems. It executes through Windows Script Host and uses Windows scripting interfaces, ActiveX objects, and dynamic scripting to support command execution, file and registry operations, environment reconnaissance, and WMI-based enumeration of security products. It also supports self-propagation to USB devices and network locations. Vjw0rm campaigns have used scheduled tasks and registry entries for persistence, and the malware has been observed deploying STRRAT as a follow-on payload.
Vjw0rm is distributed through phishing and malicious software-keygen packages. Observed delivery chains use nested self-extracting archives, compiled AutoHotkey loaders, VBScript and PowerShell stages, and legitimate paste services for payload staging. Some chains combine remotely retrieved payloads with locally embedded copies, while using legitimate applications and Windows components as camouflage.
Vjw0rm has been deployed by TA558 in campaigns targeting hospitality, hotel, and travel organizations, particularly Portuguese- and Spanish-speaking organizations in Latin America. It has also been used by TA2541, whose campaigns target aviation, aerospace, transportation, manufacturing, and defense organizations. Phishing themes associated with its distribution include reservations, travel, and judicial notifications.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since 2018, this group has used consistent tactics, techniques, and procedures to attempt to install a variety of malware including Loda RAT, Vjw0rm, and Revenge RAT.
In recent campaigns, vjw0rm and STRRAT also leveraged task creation and adding entries to the registry.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The actor sends malicious emails written in Portuguese, Spanish, and sometimes English. The emails use reservation-themed lures with business-relevant themes such as hotel room bookings.
The emails may contain malicious attachments or URLs aiming to distribute one of at least 15 different malware payloads... These early campaigns typically used malicious Word attachments that exploited Equation Editor vulnerabilities.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing Link T1566.002 Crack/keygen download lure via torrent/warez/SEO
TA2541 has also established persistence by creating scheduled tasks... In recent campaigns, vjw0rm and STRRAT also leveraged task creation... Scheduled Task: schtasks.exe /Create /TN "Updates\BQVIiVtepLtz" /XML C:\Users\[User]\AppData\Local\Temp\tmp7CF8.tmp
The functionalities of the implemented commands include: ... execute commands using cmd and powershell ... Depending on the downloaded file’s extension, it can be executed using wscript.exe, java.exe, and cmd.exe ... The RAT executes a command transmitted by the C2 server using cmd.exe ... the sent command is run via powershell.exe.
If executed, PowerShell pulls an executable from a text file hosted on various platforms such as Pastetext, Sharetext, and GitHub. The threat actor executes PowerShell into various Windows processes and queries Windows Management Instrumentation (WMI) for security products such as antivirus and firewall software, and attempts to disable built-in security protections.
They also added the ability to disable Microsoft Defender by dropping a Batch script and an LNK file pointing to that script.
The attacker uses VBsEdit to convert the VjW0rm and Houdini VBScript into an executable.
Execution Command and Scripting Interpreter: JavaScript T1059.007 Script.js, Patch.js, WindowsUpdater.js (Vjw0rm)
The RAT delivery campaign starts from an AutoHotKey compiled script... all of which start with an AHK executable that leads to the different VBScripts that eventually load the RAT.
COLCERT AL – 20260803 - 105 Alerta: Campaña phishing notificación judicial - Distribucción de VJW0rm
Then the script executes the legitimate conhost.exe application, which leads to the execution of the malicious manifest through a path hijack.
TA2541 has also established persistence by creating scheduled tasks... In recent campaigns, vjw0rm and STRRAT also leveraged task creation... Scheduled Task: schtasks.exe /Create /TN "Updates\BQVIiVtepLtz" /XML C:\Users\[User]\AppData\Local\Temp\tmp7CF8.tmp
TA2541 has also established persistence by creating scheduled tasks and adding entries in the registry... Registry: Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost Data: C:\Users[User]\AppData\Roaming\server\server.exe
They also added the ability to disable Microsoft Defender by dropping a Batch script and an LNK file pointing to that script.
TA2541 has also established persistence by creating scheduled tasks... In recent campaigns, vjw0rm and STRRAT also leveraged task creation... Scheduled Task: schtasks.exe /Create /TN "Updates\BQVIiVtepLtz" /XML C:\Users\[User]\AppData\Local\Temp\tmp7CF8.tmp
TA2541 has also established persistence by creating scheduled tasks and adding entries in the registry... Registry: Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost Data: C:\Users[User]\AppData\Roaming\server\server.exe
They also added the ability to disable Microsoft Defender by dropping a Batch script and an LNK file pointing to that script.
The commands download a known hacking tool... through an additional Powershell script that performs a known disk cleanup UAC bypass technique.
The RAT is delivered by an obfuscated VBScript... This script deobfuscates a PowerShell command... In this version, the attacker added a hexadecimal obfuscation layer to the VBScript
In this campaign, the attackers incorporate malicious scripts/executables alongside a legitimate application to disguise their intentions.
Defense Evasion Masquerading: Rename System Utilities T1036.003 Legitimate directory names (Adobe, PerfLogs, Google)
Defense Evasion Masquerading: Match Legitimate Name T1036.005 PCWDiagnostic.xml, WindowsUpdater directory, Adobe/Google paths
The second drops and executes a VBScript that terminates wscript.exe processes to clean traces of a failed attempt to perform the previous VBScript.
Defense Evasion Indicator Removal: File Deletion T1070.004 Potential cleanup after execution
Defense Evasion Deobfuscate/Decode Files T1140 Base64/XOR/ROT decoding chain in win.ps1
Then the script executes the legitimate conhost.exe application, which leads to the execution of the malicious manifest through a path hijack.
Tampering with Microsoft Defender and other antivirus products
Command and Control Application Layer Protocol: Web Protocols T1071.001 HTTPS download from upaste[.]me
This is the dead drop resolver technique (MITRE T1102.001). The attacker uploads a payload to a public service. The malware retrieves it at runtime.
If executed, PowerShell pulls an executable from a text file hosted on various platforms such as Pastetext, Sharetext, and GitHub.
This manipulation denies the DNS resolution for those domains by resolving the localhost IP address instead of the real one.
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.