MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9ec7c031a11035fadb8d1e630761489aa85d512460e77518aa196a6a112c7a06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
WSHRAT
Vendor detections: 9
| SHA256 hash: | 9ec7c031a11035fadb8d1e630761489aa85d512460e77518aa196a6a112c7a06 |
|---|---|
| SHA3-384 hash: | e1fbb153ac3ef05f17463411d3d4b953fc5c2e22f5ee6077b5525e20d3eab9d3b65ce51b6aaec9ed228a986e63c52e50 |
| SHA1 hash: | 1ad2284775d832785f5870742831f9d984bbf9b1 |
| MD5 hash: | 674c26c9c3e44f773851c14a07f87b93 |
| humanhash: | summer-november-jig-west |
| File name: | 674c26c9c3e44f773851c14a07f87b93.exe |
| Download: | download sample |
| Signature | WSHRAT |
| File size: | 472'592 bytes |
| First seen: | 2022-06-05 15:26:01 UTC |
| Last seen: | 2022-06-05 15:37:47 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e2a1496c94d52a035fe47259ee6587b7 (5 x RemoteManipulator, 2 x CoinMiner, 1 x WSHRAT) |
| ssdeep | 12288:YctEagGmcl4gBF1BRnI6hAVebOe1qOX+t4Z4+OJZdX5:ZR+cl7X1BRnI6hmebOe1qMZ4+OPf |
| Threatray | 1'891 similar samples on MalwareBazaar |
| TLSH | T14DA4AE49A3F814E4E9B39639CD518906E7B33C155B35CA9F13AC961F2F23A908D39732 |
| TrID | 92.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.6% (.EXE) Generic Win/DOS Executable (2002/3) |
| File icon (PE): |  |
| dhash icon | 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne) |
| Reporter |  abuse_ch |
| Tags: | exe wshrat |
Intelligence
File Origin
# of uploads :
2
# of downloads :
406
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
674c26c9c3e44f773851c14a07f87b93.exe
Verdict:
No threats detected
Analysis date:
2022-06-05 15:26:48 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Launching the process to interact with network services
Sending a custom TCP request
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
WSHRAT
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Uses net.exe to modify the status of services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Shell Script Host drops VBS files
Wscript called in batch mode (surpress errors)
Yara detected WSHRAT
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Alien
Status:
Malicious
First seen:
2022-05-01 09:04:59 UTC
File Type:
PE+ (Exe)
Extracted files:
17
AV detection:
15 of 26 (57.69%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'881 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence
Behaviour
Modifies registry class
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Executes dropped EXE
Unpacked files
SH256 hash:
9ec7c031a11035fadb8d1e630761489aa85d512460e77518aa196a6a112c7a06
MD5 hash:
674c26c9c3e44f773851c14a07f87b93
SHA1 hash:
1ad2284775d832785f5870742831f9d984bbf9b1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.