MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0aa70e7306349ec1f3b27d683bfb3fd717f242e86b508b4051e3691c584fbf8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
WSHRAT
Vendor detections: 7
| SHA256 hash: | 0aa70e7306349ec1f3b27d683bfb3fd717f242e86b508b4051e3691c584fbf8d |
|---|---|
| SHA3-384 hash: | 97b2750e45c9acf53ff31b6e54d282f395155ad96300bc9b0483fb55d93469d3eb1f57a27b3ba6946477d5bf99e8ca58 |
| SHA1 hash: | 8e2abd5f01f36b38d3674847dff518e7a4eef897 |
| MD5 hash: | 384b434bcfeec7287cf02b7aefa06c52 |
| humanhash: | rugby-london-salami-twelve |
| File name: | CV Actualis_.bin |
| Download: | download sample |
| Signature | WSHRAT |
| File size: | 1'795'889 bytes |
| First seen: | 2020-10-09 10:07:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer) |
| ssdeep | 49152:HAI+4uCiBg4xu/dCXr3Fbbcnn7hB2KeOK6I5vJhSnEyQh:HAI+4ia4xu/Qb3p4feOLI5xgnPQh |
| Threatray | 332 similar samples on MalwareBazaar |
| TLSH | 9B85F1A4314180BBD0A375F0FC4FCA6031AB7DDF53B4964963E7BE2ED493212129B65A |
| Reporter |  JAMESWT_WT |
| Tags: | bundle with slimpdf reader wshrat |
Intelligence
File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Wshrat
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Creating a file in the Program Files subdirectories
Deleting a recently created file
Launching a process
Sending a UDP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Creating a file in the Windows subdirectories
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Running batch commands
Creating a process with a hidden window
Searching for the window
Creating a file
Moving a recently created file
Setting a global event handler
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Launching a tool to kill processes
Unauthorized injection to a recently created process
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices by creating a special LNK file
Result
Threat name:
WSHRAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
66 / 100
Signature
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Drops script or batch files to the startup folder
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
Wscript called in batch mode (surpress errors)
Yara detected WSHRAT
Behaviour
Behavior Graph:
Threat name:
Win32.Worm.Vjworm
Status:
Malicious
First seen:
2020-10-09 10:07:26 UTC
File Type:
PE (Exe)
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 322 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence discovery
Behaviour
Kills process with taskkill
Script User-Agent
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Drops file in Program Files directory
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Blacklisted process makes network request
Executes dropped EXE
Unpacked files
SH256 hash:
0aa70e7306349ec1f3b27d683bfb3fd717f242e86b508b4051e3691c584fbf8d
MD5 hash:
384b434bcfeec7287cf02b7aefa06c52
SHA1 hash:
8e2abd5f01f36b38d3674847dff518e7a4eef897
SH256 hash:
ae802402022b7a23c5d9e6863c9587102bbc04dbcd2fb4b087309e93a7dedd34
MD5 hash:
78fd8cbc65d21ae9d82da0c6e5d9bedc
SHA1 hash:
a49e539502ba74b0eb466104f4d5335fc018adc4
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
SH256 hash:
e3b16057ccbf59a0026a0d9e257092786ed597b910a859919cb43a3eb9ba3e8f
MD5 hash:
3dd10a9d504deed70f217eff2c3113d1
SHA1 hash:
21203b5684c719ef07c4e3a091ba6878a47bc8d9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Jenxcus
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.