Vjw0rm is a worm that spreads via USB drives and has RAT capabilities because it implements different commands transmitted by the C2 server. It establishes persistence on a machine by copying to the Startup folder and creating a Run registry entry. The malware drops a Java-based RAT called STRRAT, executed using the Java executable that can be found on the local computer or downloaded from a remote URL.

JavaScript malware can be an infection vector leading to serious threats such as ransomware and spyware. We want to present a general approach that can be used to analyze any malicious JavaScript scripts…