MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7407ae87e5b4691b5b9a99158ae3418be6aa476546abad58a024ee791d841e70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7407ae87e5b4691b5b9a99158ae3418be6aa476546abad58a024ee791d841e70
SHA3-384 hash:	9010b9989c836cb7cea325ad409d28b968fcf9eda0169f05928e63a59ed807fd200ea082b465f48ff72ab76fe6785879
SHA1 hash:	551298a27c615509767296f4a85448cef9d1b02a
MD5 hash:	f9c0e7f72f05287cb2bf7209e821e1d3
humanhash:	lima-video-lamp-two
File name:	Proof Of Payment.js
Download:	download sample
Signature	Vjw0rm Alert Create hunting rule
File size:	1'035'290 bytes
First seen:	2024-09-26 10:20:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:HQGFKqpcN1UY+fCJPTrAIk9t4nx8nxYPt0Il+QrigNvU1Ol9IgzjgoL:HQGFKqpcN1UY+fCJrh9HjgoL
TLSH	T18B25E2C1619DAA27BB93CF46C66957132678C3230A4F3C11FAC23F4CAF5A84469F99D1
Magika	javascript
Reporter	abuse_ch
Tags:	js vjw0rm

abuse_ch

Vjw0rm C2:
http://rolla.wikaba.com:2025/is-ready

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

406

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

YARA.obfuscated_eval.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f5359dc5ef4567b6c9c2f8

Tags:

Discovery Execution Generic Infostealer Network Other Stealth Autorun Houdini Dunihi Worm

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/7407ae87e5b4691b5b9a99158ae3418be6aa476546abad58a024ee791d841e70

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox WSHRAT

Result

Threat name:

WSHRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1519362

Signature

Drops script or batch files to the startup folder

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Potential malicious VBS/JS script found (suspicious encoded strings)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Drops script at startup location

Sigma detected: Register Wscript In Run Key

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Yara detected WSHRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7407ae87e5b4691b5b9a99158ae3418be6aa476546abad58a024ee791d841e70/

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=oqd25b7fwrurww42tekyvy2brptkur3fi2v22wfaetxhshmedzya._file

Hatching Triage wshrat

Result

Malware family:

wshrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:wshrat execution persistence trojan

Link:

https://tria.ge/reports/240926-mdm2rssakj/

Behaviour

Script User-Agent

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Adds Run key to start application

Looks up external IP address via web service

Drops startup file

Blocklisted process makes network request

WSHRAT

Malware Config

C2 Extraction:

http://rolla.wikaba.com:2025

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/7407ae87e5b4691b5b9a99158ae3418be6aa476546abad58a024ee791d841e70