🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WSHRAT


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc
SHA3-384 hash: 5c770f238b2ac061c3ac08a52c18ddc433a52e052478917bb72890c0018f2a7c0a3002cf7ffaf8960b37e3f75f5b13b4
SHA1 hash: 45813931de14ac2f4f66d412caf9cf6fd236c5c5
MD5 hash: 8eb05c68a5880d8f15fa787b02192709
humanhash: violet-uranus-lactose-jig
File name:DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe
Download: download sample
Signature WSHRAT
Create hunting rule
File size:462'845 bytes
First seen:2023-03-21 04:05:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab6770b0a8635b9d92a5838920cfe770 (84 x Formbook, 30 x AgentTesla, 15 x Loki)
ssdeep 12288:BjKiWwykMpBMs3qLVmNwCIWaONK6ezkf4BBe/wKA3JIOb2:Bj5bMpf6L2wzWnW38zA3Zi
TLSH T139A4236C28DDE9A2D461933128B1A327F7F3875F209981170F855F7BBB604CECB09596
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon e08e125179068ee8 (1 x WSHRAT)
Reporter abuse_ch
Tags:exe RAT wshrat


Avatar
abuse_ch
WSHRAT C2:
http://ofi.dyn.ydns.io:8000/is-ready

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe
Verdict:
Malicious activity
Analysis date:
2023-03-21 04:06:34 UTC
Tags:
evasion rat strrat njrat bladabindi
Link:
https://app.any.run/tasks/9d566017-a839-4dba-894d-cf1bbbc2b5c5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/376086/
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Sanesecurity.Malware.28845.BadVBS.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Siggen.498.18366.14673.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29154.2006.5323.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29229.17537.6855.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.16622.31214.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.27284.17824.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.988.1324.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29244.9311.1371.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29268.27224.15916.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29270.6182.9849.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29296.28800.1088.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGBA.30627.12434.23722.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Creating a file
Launching a process
Creating a process with a hidden window
Searching for the window
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
DNS request
Sending a custom TCP request
Moving a recently created file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Launching a file downloaded from the Internet
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/74382/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer CVE_2021_44228 guloader overlay packed powershell sality shell32.dll strrat virus
Link:
https://www.filescan.io/uploads/64192d2be6d26a096f5743cc/reports/cdd6f9bf-9a2a-43cf-9d8c-d13fbe4b2afe/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6a6cade1-2a75-415a-9edb-4c52bf43fa41
Result
Threat name:
Njrat, STRRAT, WSHRAT
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1198236
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Drops script or batch files to the startup folder
Encrypted powershell cmdline option found
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected AllatoriJARObfuscator
Yara detected MSILLoadEncryptedAssembly
Yara detected Njrat
Yara detected STRRAT
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 831137 Sample: DF15669F7F948ABD95D1A4C326A... Startdate: 21/03/2023 Architecture: WINDOWS Score: 100 79 ofi.dyn.ydns.io 2->79 81 sonatype.map.fastly.net 2->81 83 2 other IPs or domains 2->83 97 Sigma detected: Register Wscript In Run Key 2->97 99 Snort IDS alert for network traffic 2->99 101 Multi AV Scanner detection for domain / URL 2->101 103 15 other signatures 2->103 11 DF15669F7F948ABD95D1A4C326AA0443F0CC534513B25.exe 7 13 2->11         started        14 wscript.exe 2->14         started        17 wscript.exe 2->17         started        19 2 other processes 2->19 signatures3 process4 file5 69 C:\Users\user\AppData\...\sfvip player.exe, PE32+ 11->69 dropped 71 C:\Users\user\AppData\Roaming\System.VBS, ASCII 11->71 dropped 73 C:\Users\...\System.Certificates.Windows.js, ASCII 11->73 dropped 75 2 other malicious files 11->75 dropped 21 wscript.exe 2 11->21         started        25 mshta.exe 1 11->25         started        27 wscript.exe 3 16 11->27         started        32 2 other processes 11->32 125 Wscript called in batch mode (surpress errors) 14->125 30 wscript.exe 14->30         started        signatures6 process7 dnsIp8 63 C:\ProgramData\rrrrrrrr.ps1, ASCII 21->63 dropped 113 System process connects to network (likely due to code injection or exploit) 21->113 115 Wscript starts Powershell (via cmd or directly) 21->115 117 May check the online IP address of the machine 21->117 123 2 other signatures 21->123 34 powershell.exe 15 16 21->34         started        119 Suspicious powershell command line found 25->119 121 Encrypted powershell cmdline option found 25->121 38 powershell.exe 25->38         started        87 ofi.dyn.ydns.io 141.98.10.75, 49703, 49758, 49787 HOSTBALTICLT Lithuania 27->87 89 ip-api.com 208.95.112.1, 49702, 80 TUT-ASUS United States 27->89 65 C:\Users\...\System.Certificates.Windows.js, ASCII 27->65 dropped 91 github.com 140.82.121.3, 443, 49698, 49708 GITHUBUS United States 32->91 93 140.82.121.4, 443, 49736, 49740 GITHUBUS United States 32->93 95 3 other IPs or domains 32->95 41 icacls.exe 32->41         started        43 WerFault.exe 32->43         started        file9 signatures10 process11 dnsIp12 85 files.catbox.moe 107.160.74.134, 443, 49796, 49801 AS40676US United States 34->85 105 Suspicious powershell command line found 34->105 107 Encrypted powershell cmdline option found 34->107 109 Drops PE files with a suspicious file extension 34->109 111 Powershell drops PE file 34->111 45 RegAsm.exe 34->45         started        49 conhost.exe 34->49         started        67 C:\Users\user\AppData\Roaming\wcqvss.com, PE32 38->67 dropped 51 wcqvss.com 38->51         started        53 conhost.exe 38->53         started        55 powershell.exe 38->55         started        57 conhost.exe 41->57         started        file13 signatures14 process15 file16 77 C:\...\cde55e52fb830e966551ebb867b911f6.exe, PE32 45->77 dropped 127 Drops PE files to the startup folder 45->127 129 Uses netsh to modify the Windows network and firewall settings 45->129 131 Modifies the windows firewall 45->131 59 netsh.exe 45->59         started        133 Antivirus detection for dropped file 51->133 135 Multi AV Scanner detection for dropped file 51->135 137 Machine Learning detection for dropped file 51->137 signatures17 process18 process19 61 conhost.exe 59->61         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc/
Threat name:
Win32.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 14:18:01 UTC
File Type:
PE (Exe)
Extracted files:
120
AV detection:
29 of 39 (74.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=34kwnh37ssfl3forutbsnkqeipymyu2fcozfhlgp7c6sksnd6poa._file
Verdict:
malicious
Result
Malware family:
wshrat
Create hunting rule
Score:
  10/10
Tags:
family:njrat family:wshrat botnet:ofiss persistence trojan
Link:
https://tria.ge/reports/230321-en3wzagg29/
Behaviour
Modifies registry class
Script User-Agent
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
WSHRAT
njRAT/Bladabindi
Malware Config
C2 Extraction:
ofi.dyn.ydns.io:5553
http://ofi.dyn.ydns.io:8000
Dropper Extraction:
https://files.catbox.moe/hw5nal.jpg
Unpacked files
SH256 hash:
df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc
MD5 hash:
8eb05c68a5880d8f15fa787b02192709
SHA1 hash:
45813931de14ac2f4f66d412caf9cf6fd236c5c5
Link:
https://www.unpac.me/results/32550263-7cbf-4170-b53e-0621cfbf3916/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df15669f7f94/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df15669f7f948abd95d1a4c326aa0443f0cc534513b253accff8bd2549a3f3dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/376086/

Comments