🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WSHRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159
SHA3-384 hash: 49cd8e5056f17ff0df324e82e4e57e4743af688a77ef421b64d664716a69e5b1836b77e600d81099e0c2274472607cf0
SHA1 hash: bba049bef2c27a3e5fc45022032255683e7f533c
MD5 hash: 341de6c143847fae0439d76144f8cf9f
humanhash: mobile-lake-romeo-snake
File name:ORDER-40569-006784.XLS.vbs
Download: download sample
Signature WSHRAT
Create hunting rule
File size:22'479 bytes
First seen:2025-08-19 05:21:19 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:IgVz7UDwaBgwoJw78TSm44GEsizU1qjgnOK8+:zVPUcaBvoy7XmnGVrOK8+
Threatray 848 similar samples on MalwareBazaar
TLSH T103A2A63EECDEB939D4D0340D68ED0839DE402391818779BC0EA5E259F816A1DE7C629F
Magika vba
Reporter abuse_ch
Tags:vbs wshrat

Intelligence

File Origin
# of uploads :
1
# of downloads :
413
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/22039/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a40a30c2f5296a1a284045
Tags:
vmdetect autorun neshta
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68a40a21a4bdac9f5b9d82f9/reports/26e00a4e-3562-4d73-8fc3-5e7e7239807b/overview
Verdict:
Malicious
Labled as:
Trojan.Script.Dropper
Link:
https://www.hybrid-analysis.com/sample/3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159
Result
Threat name:
WSHRat, AsyncRAT, Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1759874
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Creates multiple autostart registry keys
Detected WSHRat
Drops script or batch files to the startup folder
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (has network functionality)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sample uses string decryption to hide its real strings
Sigma detected: Cscript/Wscript Uncommon Script Extension Execution
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Neshta
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1759874 Sample: ORDER-40569-006784.XLS.vbs Startdate: 19/08/2025 Architecture: WINDOWS Score: 100 93 umar33myddns.rocks 2->93 95 offer5302025.mooo.com 2->95 97 10 other IPs or domains 2->97 105 Sigma detected: Register Wscript In Run Key 2->105 107 Suricata IDS alerts for network traffic 2->107 109 Found malware configuration 2->109 111 24 other signatures 2->111 14 wscript.exe 3 2 2->14         started        18 Windows Audio.exe 2->18         started        20 Windows Audio.exe 2->20         started        22 3 other processes 2->22 signatures3 process4 file5 85 C:\Users\user\AppData\Local\Temp\fuPmj.js, ASCII 14->85 dropped 125 Benign windows process drops PE files 14->125 127 Detected WSHRat 14->127 129 VBScript performs obfuscated calls to suspicious functions 14->129 137 3 other signatures 14->137 24 wscript.exe 1 15 14->24         started        131 Injects a PE file into a foreign processes 18->131 28 Windows Audio.exe 18->28         started        30 Windows Audio.exe 18->30         started        32 Windows Audio.exe 20->32         started        133 System process connects to network (likely due to code injection or exploit) 22->133 135 Wscript called in batch mode (surpress errors) 22->135 34 wscript.exe 22->34         started        signatures6 process7 dnsIp8 99 ccihunedoara.ro 91.212.66.16, 443, 49718 ALFA-WEB-ASAleeaCrizantemelornr1RO Romania 24->99 115 System process connects to network (likely due to code injection or exploit) 24->115 117 Windows Scripting host queries suspicious COM object (likely to drop second stage) 24->117 36 wscript.exe 3 24->36         started        signatures9 process10 file11 75 C:\Users\user\AppData\Local\Temp\svchost.js, ASCII 36->75 dropped 39 wscript.exe 2 36->39         started        42 wscript.exe 3 3 36->42         started        process12 file13 77 C:\Users\user\AppData\Local\Temp\Wrl.exe, PE32 39->77 dropped 44 Wrl.exe 4 39->44         started        48 Windows Audio.exe 39->48         started        51 wscript.exe 1 3 42->51         started        53 EXCEL.EXE 42->53         started        process14 dnsIp15 79 C:\Users\user\AppData\Local\Temp\...\Wrl.exe, PE32 44->79 dropped 119 Antivirus detection for dropped file 44->119 55 Wrl.exe 44->55         started        89 umar33myddns.rocks 34.41.139.193, 49739, 5670 ATGS-MMD-ASUS United States 48->89 81 C:\Users\user\AppData\Roaming\...\Filname.js, ASCII 51->81 dropped 83 C:\Users\user\AppData\Roaming\Filname.js, ASCII 51->83 dropped 121 Creates multiple autostart registry keys 51->121 123 Wscript called in batch mode (surpress errors) 51->123 58 wscript.exe 51->58         started        91 s-part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49759, 49763 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 53->91 61 splwow64.exe 53->61         started        file16 signatures17 process18 dnsIp19 113 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 55->113 63 Wrl.exe 55->63         started        101 jamesrockky.ydns.eu 46.246.14.5, 2703, 49725, 49731 PORTLANEwwwportlanecomSE Sweden 58->101 signatures20 process21 file22 87 C:\Users\user\AppData\...\Windows Audio.exe, PE32 63->87 dropped 103 Creates multiple autostart registry keys 63->103 67 cmd.exe 63->67         started        signatures23 process24 process25 69 conhost.exe 67->69         started        71 timeout.exe 67->71         started        73 Windows Audio.exe 67->73         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159
Verdict:
Malware
YARA:
1 match(es)
Tags:
AdoDb.stream DeObfuscated Microsoft.xmldom Obfuscated SCRipting.filesystemobject T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/341de6c143847fae0439d76144f8cf9f
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159/
Threat name:
Script-WScript.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 05:22:38 UTC
File Type:
Text (VBS)
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkj6l3gpicsaz4ltoyogxh4k4oowne2l4wddlspbtzgjh3ym2fmq._file
Verdict:
malicious
Label(s):
neshta
Create hunting rule
Similar samples:
0181b8118922941d69da3e16674bcdfa319c07b81c20991fe2b0ed7ea2bd2c7a
WSHRAT
0c0c9a19db1f89d94ddcd8af54fa631798e3ccc82743faae6d9818759f2dbcc1
WSHRAT
2e5b9ebfb2b81c5e512248e2e9224d1054defc4b027c0108fc10d268312ce290
WSHRAT
548e403cfad22d1e87842b66925f31b64cae77d1f5371b845cb1dcd66fe99a92
WSHRAT
889c2ec3e88c2a47de4bcc6d88cb74d21a01088330fb240788c81968ba16155b
WSHRAT
b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b
WSHRAT
d5f162d4ab50a806c77d3462307ddaefb30135bb6a8ecbe75afc253a2c3cbd2c
WSHRAT
e1b0ef4dd27c829683569165d98c902a8ed2f2eaa95b1540c6430f5ea3be0b3f
WSHRAT
error
WSHRAT
+ 838 additional samples on MalwareBazaar
Result
Malware family:
wshrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:neshta family:wshrat botnet:default-aug 25-16 defense_evasion discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/250819-f2zxxazrx7/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Script User-Agent
Scheduled Task/Job: Scheduled Task
Modifies registry class
Enumerates system info in registry
Delays execution with timeout.exe
Checks processor information in registry
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Command and Scripting Interpreter: JavaScript
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Modifies system executable filetype association
Executes dropped EXE
Drops startup file
Checks computer location settings
Modifies trusted root certificate store through registry
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Wshrat family
WSHRAT
Neshta family
Neshta
Detect Neshta payload
Asyncrat family
AsyncRat
Malware Config
C2 Extraction:
jamesrockky.ydns.eu:2703
jamesrockky.ydns.eu:5670
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:5670
umar33myddns.rocks:2703
umar33myddns.rocks:5670
zoo33.myddns.rocks:2703
zoo33.myddns.rocks:5670
http://offer5302025.mooo.com:7045
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22039/

Comments