Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Old Worm But New Obfuscation Technique SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Old Worm But New Obfuscation Technique

Yesterday I found an interesting JavaSvript script delivered through a regular phishing campaign (SHA256:70c0b9d1c88f082bad6ae01fef653da6266d0693b24e08dcb04156a629dd6f81) and has a VT score of 17/61[1]

The script obfuscation is simple but effective: the malicious code is decoded and passed to an eval() function to be executed:

function wrwrwrwererw(iyuiyiyuiyiyyui,jljkljkllljkllklklkj) {
    var wqwqsdasda;
    var popopoppop="";
    var xxxxxxxzzzzzzzzzz=(iyuiyiyuiyiyyui+"").split("");
    var rwerwwrwrww0=(jljkljkllljkllklklkj+"").split("");
    var ererrer545=rwerwwrwrww0.length;
    for (var aaaaa888=0;aaaaa888<xxxxxxxzzzzzzzzzz.length;aaaaa888++){
    return popopoppop;

eval(wrwrwrwererw(" <malicious_data> ", "123");

The payload is a string of Unicode characters converted one by one through the wrwrwrwererw() function.

The first character is the 'cyrillic capital letter ef' which has the decimal code 1060. The decoding is performed by the following line:


The returned char will be '/' (ASCII code 47). You don't have to decode this manually, just replace eval() by echo() and you'll get the decoded script. Let's have a look at it. The new script is also obfuscated but it remains easy to read. At the very beginning of the script, you have got this line:

var g = ["HKCU","HKLM","HKCU\\vjw0rm","\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\","HKLM\\SOFTWARE\\Classes\\","REG_SZ","\\defaulticon\\"];

It's a sample of the vjw0rm worm that was discovered for the first time in 2018! [2]. If you want to have a look at the code, a version is available on GitHub.[3]

This worm has been used multiple times in miscellaneous campaigns and it seems to be still active today. The C2 server is hxxp://dhanaolaipallets[.]com:7974/. Note that, thanks to the new obfuscation technique, the VT score remains low!


Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant

I will be teaching next: Reverse-Engineering Malware: Malware Analysis Tools and Techniques - SANS Threat Hunting London 2022


649 Posts
ISC Handler
Nov 13th 2020

Sign Up for Free or Log In to start participating in the conversation!