MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 173136a6c173363068e7d7d16907f7fa38ec0d717dff663057304ee54adde4d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	173136a6c173363068e7d7d16907f7fa38ec0d717dff663057304ee54adde4d7
SHA3-384 hash:	45ec6c45b374e0992c6fcf8a75e72d6e764e0d1b1cd31439d9f74c7f3cff7f307b479afd1bcaff58da3f4a4f4919784f
SHA1 hash:	5731e7270d31672ba15f038271d16da68d56e148
MD5 hash:	6afc65fd8742615b1505ec80ed3b40f6
humanhash:	alanine-vegan-london-item
File name:	ORDER231804List.vbs
Download:	download sample
Signature	Vjw0rm Alert Create hunting rule
File size:	255'762 bytes
First seen:	2023-04-18 07:55:23 UTC
Last seen:	2023-04-20 07:50:52 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	768:se4mo/QE6/2eWU6c25NXZ1kSEHSTYeB/AiAkpjXnd/NC:Td2tHuSg
TLSH	T1EC4432023D8BFA3C155F2C0465302E768F8EFE71C61951A22A496F3D83AB58D177F52A
Reporter	abuse_ch
Tags:	vbs vjw0rm

abuse_ch

Vjw0rm C2:
103.47.144.71:7045

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

132

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28955.VbsHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/643e4d1246e0911fda9ebe6b/reports/2b68628b-0aee-471e-83b4-2e1018c06125/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/173136a6c173363068e7d7d16907f7fa38ec0d717dff663057304ee54adde4d7

Joe Sandbox WSHRat

Result

Threat name:

WSHRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1217587

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Detected WSHRat

Drops VBS files to the startup folder

Found malware configuration

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Drops script at startup location

Sigma detected: Register Wscript In Run Key

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

VBScript performs obfuscated calls to suspicious functions

Windows Shell Script Host drops VBS files

Wscript called in batch mode (surpress errors)

Yara detected WSHRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/173136a6c173363068e7d7d16907f7fa38ec0d717dff663057304ee54adde4d7/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Valyria

Threat name:

Script-WScript.Trojan.Valyria

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-18 02:22:25 UTC

File Type:

Text (VBS)

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=c4ytnjwbom3da2hh27iwsb7x7i4oydlrpx7wmmcxgbhoksw54tlq._file

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/173136a6c173/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Vjw0rm

Threat name:

Vjw0rm

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/173136a6c173363068e7d7d16907f7fa38ec0d717dff663057304ee54adde4d7