Vjworm

Overview

Worm:VBS/Vjworm (and its variants like JS/Vjworm) is a highly aggressive, self-propagating worm written in scripting languages (Visual Basic Script or JavaScript). Its defining characteristic is its heavy reliance on Removable Media (USB drives) for propagation (`T1091`), making it a significant threat to air-gapped or poorly segmented operational technology (OT) environments.

Understanding VJWorm
To an end-user, an infection often starts when they plug in an infected USB drive; their legitimate files appear to have vanished, replaced by 'shortcuts' that look like their folders. For a security team, VJWorm is a highly visible, persistent nuisance that indicates a failure in USB device control policies. While primarily a worm, it also functions as a backdoor, allowing the attacker to download additional payloads or steal data.

Execution and Propagation Mechanics
VJWorm is distributed initially via malicious downloads or spam, but its primary vector is lateral movement via USB. When a clean USB drive is inserted into an infected machine, VJWorm copies its heavily obfuscated script file (often `.vbs`, `.js`, or `.wsf`) to the drive. Crucially, it then hides all legitimate files and folders on the USB drive (`T1564.001`) and creates Windows Shortcut (`.lnk`) files (`T1566.001`) with the same names as the hidden folders. When a user on a *new* machine clicks the shortcut to open their 'folder', the shortcut actually executes the VJWorm script via `wscript.exe`, infects the new host, and *then* opens the legitimate folder to avoid suspicion. It establishes persistence on the host via the Registry Run keys.

Indicators of Compromise & Impact
The impact ranges from significant operational disruption (network congestion, hidden files) to data exfiltration via the backdoor capability. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from suspicious locations (like the root of a USB drive or `%AppData%`), and the presence of suspicious `.lnk` files on removable media. Network IoCs include the script reaching out to dynamic DNS domains for C2 instructions.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_VJWORM {
    meta:
        description = "Detects Vjworm (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "vjworm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Vjworm Activity
id: 29c9d6a2742e971bfa40d18a979e10df
status: experimental
description: Detects generic indicators of the vjworm malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*vjworm*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately enforce USB port blocking (Device Control) across the enterprise to halt lateral propagation.
2. Isolate infected machines to prevent the worm from reaching out to its C2 server or attempting network share propagation.
3. Run a script to unhide all files (`attrib -h -s -r /s /d *.*`) and delete the malicious `.lnk` files and `.vbs`/`.js` payloads on affected drives.
4. Review the Registry Run keys (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) for entries executing `wscript.exe`.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the `.lnk` files on the USB drive; you must unhide the user's actual files to restore functionality.
2. Avoid allowing Autoplay/Autorun for removable media, as this facilitates the automatic execution of some worm variants.

References & External Analysis

• Search "vjworm" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Mytob
• Rpdpatch
• Winvnc
• Shadowhammer
• Keydoor

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/vjworm.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.