MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cf7bad0b2b13efccb7df15f015ec51d766d5a63a2b5acec200fff093c6d70c03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
WSHRAT
Vendor detections: 11
| SHA256 hash: | cf7bad0b2b13efccb7df15f015ec51d766d5a63a2b5acec200fff093c6d70c03 |
|---|---|
| SHA3-384 hash: | 4266ca78925bf7d91d97655fcb7986404e9d3f4a93bb2efda8cb155e89fd22e63e16d000cee008af0f02f2b838608b65 |
| SHA1 hash: | 48d83b26a75a03a6ca067ff44d208cc1c47b7bd5 |
| MD5 hash: | 0dd05e9a74cdc3e174bec63b67cd86db |
| humanhash: | arkansas-west-gee-mango |
| File name: | 0dd05e9a74cdc3e174bec63b67cd86db |
| Download: | download sample |
| Signature | WSHRAT |
| File size: | 891'599 bytes |
| First seen: | 2022-11-15 12:54:00 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki) |
| ssdeep | 24576:XlZT3TaGspPse/LltOOr3C1zC+GGOG4emawVl9RK:VZHaGese/73H+GS4XawVrQ |
| Threatray | 3'240 similar samples on MalwareBazaar |
| TLSH | T13F153352AACD9C7BFA56BF3254411F32833FA807975A5C8A076411EA09B770FD3E908D |
| TrID | 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe wshrat |
Intelligence
File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0dd05e9a74cdc3e174bec63b67cd86db
Verdict:
Malicious activity
Analysis date:
2022-11-15 12:54:46 UTC
Tags:
autoit
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Creating a file in the %AppData% directory
Сreating synchronization primitives
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Launching the default Windows debugger (dwwin.exe)
Enabling the 'hidden' option for recently created files
Searching for the window
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
lokibot overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
WSHRAT
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential evasive VBS script found (sleep loop)
Potential malicious VBS script found (has network functionality)
Potential malicious VBS script found (suspicious strings)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Windows Shell Script Host drops VBS files
Wscript called in batch mode (surpress errors)
Yara detected WSHRAT
Behaviour
Behavior Graph:
Threat name:
Win32.Worm.Jenxcus
Status:
Malicious
First seen:
2022-11-15 12:55:11 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
14 of 26 (53.85%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 3'230 additional samples on MalwareBazaar
Result
Malware family:
wshrat
Score:
10/10
Tags:
family:wshrat persistence trojan
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
WSHRAT
WSHRAT payload
Malware Config
C2 Extraction:
http://snkcyp.duckdns.org:44147
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
0b988a410ef45522a17a20f10c43b1fcd6313ffb4215df6801a5d731687e809a
MD5 hash:
09d29c4eac2154c87c37045ed8ddeb40
SHA1 hash:
da79591e7f2878328c55d803b5e6e2fc7215bc00
SH256 hash:
4b0f32178b931d0a9cc682a9fd161673d9b021a07fc5e87cc4388d9e84832e7f
MD5 hash:
762fa25a20464514c96a9820ada39dfc
SHA1 hash:
a9be799f7b3a4c5ebd2e23f3d721556c0591c273
SH256 hash:
58c2f45c86a0855f2a1ed8409532914dbec6f561dc0b606bd014178c81d1c6ad
MD5 hash:
fa9037616a426f7744821387040f37d4
SHA1 hash:
6b3d17b7a5328bcce09c160d0158bb9d2889c6c8
SH256 hash:
cf7bad0b2b13efccb7df15f015ec51d766d5a63a2b5acec200fff093c6d70c03
MD5 hash:
0dd05e9a74cdc3e174bec63b67cd86db
SHA1 hash:
48d83b26a75a03a6ca067ff44d208cc1c47b7bd5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://207.167.64.143/yuhuu.exe