MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6
SHA3-384 hash:	b9f9b3f55298c642bb148eb3cc17b4f54ce133cdde7414bdf2c9ba38ff0b312300caccbb5650e4034cc5377de3fd88a9
SHA1 hash:	b2f9383257887b902b25c7f24e1d6320cb88acea
MD5 hash:	678f7bc2963dfe7d00f80de5132f63af
humanhash:	pluto-may-juliet-four
File name:	ORDER-230428.js
Download:	download sample
Signature	WSHRAT Alert Create hunting rule
File size:	533'634 bytes
First seen:	2023-04-29 14:17:24 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:lilWWgNgxgygHWWWWW/IHWWWWWXgHBq8iOAwI4LuRu1kKMiIeBWSPSHv7rWektWW:d1H0Ef
TLSH	T181B4A3FCF1051F22D392611C9AE9081873B3D720F4E9DF14666C660AC2EE92B57C9ED9
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	TeamDreier
Tags:	js wshrat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

140

Origin country :

DK

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28399.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/644d271d961a21dc785bf282/reports/5ca6d89c-6cd2-4193-949b-39bbc01c7850/overview

Hybrid Analysis Backdoor.Script.Agent

Verdict:

Malicious

Labled as:

Backdoor.Script.Agent

Link:

https://www.hybrid-analysis.com/sample/749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox WSHRat

Result

Threat name:

WSHRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1223640

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Creates autostart registry keys with suspicious names

Detected WSHRat

Drops script or batch files to the startup folder

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Register Wscript In Run Key

Wscript called in batch mode (surpress errors)

Yara detected WSHRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6/

ReversingLabs TitaniumCloud Script-JS.Trojan.Vjw0rm

Threat name:

Script-JS.Trojan.Vjw0rm

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-29 12:57:52 UTC

File Type:

Text

AV detection:

9 of 37 (24.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oskqqvyp33lqshrdk4d32oq7oldeyjbiqavlv6vjrrd45fymrx3a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6