🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WSHRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425
SHA3-384 hash: c87da4afbf6fa9a330d01d2882ac98d34c4e680119a4a50eaa7eb0638a6bd88fb3b9255fc177b06c7c471ef2c4d210e6
SHA1 hash: cfe195a981cad4c1ab7613639ef183a63b4d5407
MD5 hash: 91e1450d1ada0ac9449c8d075c1d5777
humanhash: island-september-blossom-fruit
File name:ORDER50423.pdf.vbs
Download: download sample
Signature WSHRAT
Create hunting rule
File size:244'149 bytes
First seen:2023-04-05 06:30:34 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:7KP2y6P4YDe1qkFc/kfcv/Dxf8vXIxOQzzM4MUnJtzJH/S:s
TLSH T18F3415023D8BFA3C155F2D0565302E769F8EFE75C61951A22A496F3D83AB08D137F42A
Reporter abuse_ch
Tags:RAT vbs wshrat


Avatar
abuse_ch
WSHRAT C2:
103.47.144.67:7045

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28955.VbsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/642d15a935c10d8aaf28a55b/reports/57ec3909-80e9-42e7-b609-9f4b27ad56ce/overview
Verdict:
Malicious
Labled as:
Valyria
Link:
https://www.hybrid-analysis.com/sample/76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425
Result
Threat name:
WSHRat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1208714
Signature
C2 URLs / IPs found in malware configuration
Detected WSHRat
Drops VBS files to the startup folder
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
System process connects to network (likely due to code injection or exploit)
Uses an obfuscated file name to hide its real file extension (double extension)
VBScript performs obfuscated calls to suspicious functions
Windows Shell Script Host drops VBS files
Wscript called in batch mode (surpress errors)
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425/
Threat name:
Script-WScript.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2023-04-05 06:31:10 UTC
File Type:
Text (VBS)
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3xyulcld4hqgs7d63pelhovjsvaxkmh3g5ja23r7nb3jeo4iqsq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/230405-mlhr1sfb4y/
Behaviour
Enumerates physical storage devices
Adds Run key to start application
Drops startup file
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76ef8a2c4b1f0f034be3f6de459dd54caa0ba987d9ba906b71fb43b491dc4425

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments