MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 185182f369edcb96118a91dcad39eb5b63239112ed6963a8c274178bf1b55394. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



WSHRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments

SHA256 hash: 185182f369edcb96118a91dcad39eb5b63239112ed6963a8c274178bf1b55394
SHA3-384 hash: 5418b1d2bf4374a42c0b667376703e7e3b8d199e59505bdb24808468a904f6648a61f7a25b500c0c4aac50b591c42289
SHA1 hash: 737c0d37815c7c22b036c1edba100a95a67ae671
MD5 hash: 4b685bd75281e7d4fd5d5c6ea517f7b4
humanhash: triple-west-mirror-oven
File name:houdini.vbs.vir
Download: download sample
Signature WSHRAT
File size:14'261 bytes
First seen:2022-06-17 10:56:54 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:IzzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:IzxqagRYwZSGECXCgMmsgV/N
TLSH T15B52D94BAA8D8D3A8B3192914D07100AE7D0428B221575847EDCD8C57F3596ED3E3AFF
Reporter @DSTLabs
Tags:Houdini hworm sansisc wshrat

Intelligence


File Origin
# of uploads :
1
# of downloads :
169
Origin country :
BE BE
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Result
Threat name:
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops VBS files to the startup folder
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (has network functionality)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Windows Shell Script Host drops VBS files
Wscript called in batch mode (surpress errors)
Yara detected WSHRAT
Behaviour
Behavior Graph:
Threat name:
Script-WScript.Worm.Jenxcus
Status:
Malicious
First seen:
2022-06-17 10:57:04 UTC
File Type:
Text (VBS)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Behaviour
Enumerates physical storage devices
Adds Run key to start application
Drops startup file
Blocklisted process makes network request

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments