🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f82e5e6ba614031d24cb1460149e658eb3b4b9b0372dda40989ea413feae185c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WSHRAT


Vendor detections: 16


Intelligence 16 IOCs 2 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f82e5e6ba614031d24cb1460149e658eb3b4b9b0372dda40989ea413feae185c
SHA3-384 hash: 64ad32650dec5560cef4ee2e38ca1212f52045ecc7d78507042d34b3326dbe3795ae89ca94d6ef19549524fc8d085064
SHA1 hash: 0f06400fd1e6e0003e90e6e289ef53b968ddb6dd
MD5 hash: 803238fd75925bebb2d385b7c472b8f7
humanhash: freddie-wyoming-missouri-orange
File name:F82E5E6BA614031D24CB1460149E658EB3B4B9B0372DD.exe
Download: download sample
Signature WSHRAT
Create hunting rule
File size:4'307'056 bytes
First seen:2022-10-20 08:10:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab6770b0a8635b9d92a5838920cfe770 (84 x Formbook, 30 x AgentTesla, 15 x Loki)
ssdeep 98304:vFEn+sPuptl3GCXOStfnCKWdZkkby1/++UIAr:vREupr/XO+CDdZPby1/ZUIe
TLSH T1BB1633A06B33866CCAB08C39155F16B37160229FACBB43694711CDFBE9A1766CD37352
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0040bee4e4ba0000 (1 x WSHRAT)
Reporter abuse_ch
Tags:exe RAT wshrat


Avatar
abuse_ch
WSHRAT C2:
http://svchost.ydns.eu:8000/is-ready

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://svchost.ydns.eu:8000/is-ready https://threatfox.abuse.ch/ioc/895109/
57.128.45.1:8000 https://threatfox.abuse.ch/ioc/895110/

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://mega.nz/file/JZBlXSwR#cDl_zdokYdMJAafphUT8LERG-zcBVBKNrnkc6i0-nYs
Verdict:
Malicious activity
Analysis date:
2022-02-26 15:54:40 UTC
Tags:
trojan rat redline evasion strrat
Link:
https://app.any.run/tasks/6720a76a-e232-4c7c-9872-ebb3f1e6f319

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/321928/
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

PUA.Win.Packer.Asprotect-3
Create hunting rule

SecuriteInfo.com.Java.Siggen.498.18366.14673.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29154.2006.5323.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29229.17537.6855.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.16622.31214.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.27284.17824.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29230.988.1324.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29244.9311.1371.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29268.27224.15916.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29270.6182.9849.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.29296.28800.1088.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGBA.30627.12434.23722.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-2090.UNOFFICIAL
Create hunting rule

Win.Packed.Fragtor-9940182-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Launching a process
Creating a file
Searching for the window
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Moving a recently created file
Running batch commands
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Launching a tool to kill processes
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/43939/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer overlay packed quasar shell32.dll strrat
Link:
https://www.filescan.io/uploads/6351029736b2f81d638458b7/reports/6264cc48-56f1-4177-ae39-a8fefffb2667/overview
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/96dcc0cf-5e34-48fa-bade-55fff6e8a6c7
Result
Threat name:
RedLine, WSHRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1094004
Signature
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to log keystrokes (.Net Source)
Drops script or batch files to the startup folder
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Wscript starts Powershell (via cmd or directly)
Yara detected RedLine Stealer
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 726640 Sample: F82E5E6BA614031D24CB1460149... Startdate: 20/10/2022 Architecture: WINDOWS Score: 100 69 svchost.ydns.eu 2->69 71 sonatype.map.fastly.net 2->71 73 3 other IPs or domains 2->73 85 Sigma detected: Register Wscript In Run Key 2->85 87 Snort IDS alert for network traffic 2->87 89 Multi AV Scanner detection for domain / URL 2->89 91 18 other signatures 2->91 9 F82E5E6BA614031D24CB1460149E658EB3B4B9B0372DD.exe 5 14 2->9         started        12 wscript.exe 2->12         started        15 wscript.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 file5 57 C:\Users\user\AppData\Roaming\Scr.exe, PE32 9->57 dropped 59 C:\Users\user\...\ONLYFANS CHECKER.exe, PE32 9->59 dropped 61 C:\Users\user\AppData\Roaming\User.vbs, Unicode 9->61 dropped 63 3 other malicious files 9->63 dropped 19 wscript.exe 3 16 9->19         started        24 ONLYFANS CHECKER.exe 1 9->24         started        26 Scr.exe 1 9->26         started        30 3 other processes 9->30 113 Wscript called in batch mode (surpress errors) 12->113 28 wscript.exe 12->28         started        signatures6 process7 dnsIp8 75 svchost.ydns.eu 57.128.45.1, 1000, 49698, 49787 ATGS-MMD-ASUS Belgium 19->75 77 ip-api.com 208.95.112.1, 49697, 80 TUT-ASUS United States 19->77 49 C:\Users\user\AppData\Roaming\kl-plugin.exe, PE32 19->49 dropped 51 C:\Users\user\AppData\...setNod32.js, ASCII 19->51 dropped 93 System process connects to network (likely due to code injection or exploit) 19->93 95 Wscript starts Powershell (via cmd or directly) 19->95 97 May check the online IP address of the machine 19->97 111 3 other signatures 19->111 99 Writes to foreign memory regions 24->99 101 Allocates memory in foreign processes 24->101 103 Injects a PE file into a foreign processes 24->103 32 AppLaunch.exe 24->32         started        35 conhost.exe 24->35         started        105 Antivirus detection for dropped file 26->105 107 Multi AV Scanner detection for dropped file 26->107 109 Machine Learning detection for dropped file 26->109 37 powershell.exe 14 16 26->37         started        79 github.com 140.82.121.3, 443, 49696, 49702 GITHUBUS United States 30->79 81 140.82.121.4, 443, 49746, 49747 GITHUBUS United States 30->81 83 3 other IPs or domains 30->83 53 C:\Users\user\AppData\Roaming\...\User.vbs, Unicode 30->53 dropped 55 C:\ProgramData\rrrrrrrr.ps1, ASCII 30->55 dropped 39 powershell.exe 3 30->39         started        41 icacls.exe 1 30->41         started        file9 signatures10 process11 dnsIp12 65 45.87.155.189, 20856 ASN-POSTLTDRU Russian Federation 32->65 67 files.catbox.moe 107.160.74.131, 443, 49692, 49780 AS40676US United States 37->67 43 conhost.exe 37->43         started        45 conhost.exe 39->45         started        47 conhost.exe 41->47         started        process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f82e5e6ba614031d24cb1460149e658eb3b4b9b0372dda40989ea413feae185c/
Threat name:
Win32.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2022-02-26 23:49:19 UTC
File Type:
PE (Exe)
Extracted files:
78
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7axf425gcqbr2jglcrqbjhtfr2z3jonqg4w5uqeyt2sbh7vodboa._file
Verdict:
malicious
Result
Malware family:
wshrat
Create hunting rule
Score:
  10/10
Tags:
family:redline family:strrat family:wshrat infostealer persistence stealer trojan
Link:
https://tria.ge/reports/221020-j29nwschan/
Behaviour
Kills process with taskkill
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
RedLine
RedLine payload
STRRAT
WSHRAT
Malware Config
C2 Extraction:
45.87.155.189:20856
http://svchost.ydns.eu:8000
Dropper Extraction:
https://files.catbox.moe/3pwn9k.jpg
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e17e63e9-6e12-4570-8b16-9f19857e7468
Unpacked files
SH256 hash:
fea8d685b7c1404e24e4439c5cd7c5b17278cac4d0865ac64913849f3af1f126
MD5 hash:
30ecd0e9e87adee7ef375224a1a0f4d2
SHA1 hash:
99257140acb8af41930d0680198359345b761a06
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/8ac98c93-640f-4dd0-9f15-d6d934cb655a/
SH256 hash:
aa0b9ccdf16ec47e8e4150e694f7750f826659826ed6b6d0ddf39337bb3fd19a
MD5 hash:
d67b4c273789f152fde774866e1ae405
SHA1 hash:
625e17bfaa54d564a931a7a3d732f59308ab1b69
Link:
https://www.unpac.me/results/8ac98c93-640f-4dd0-9f15-d6d934cb655a/
SH256 hash:
a0f5f7c21dd002a760f42112143c79ea9db49c89e70f7927c69f8c8445cf1df9
MD5 hash:
35d961877724d27b68aec60191d32a2e
SHA1 hash:
19315ee9ff184ae4f97a9d7f01d6723367695063
Link:
https://www.unpac.me/results/8ac98c93-640f-4dd0-9f15-d6d934cb655a/
SH256 hash:
f82e5e6ba614031d24cb1460149e658eb3b4b9b0372dda40989ea413feae185c
MD5 hash:
803238fd75925bebb2d385b7c472b8f7
SHA1 hash:
0f06400fd1e6e0003e90e6e289ef53b968ddb6dd
Link:
https://www.unpac.me/results/8ac98c93-640f-4dd0-9f15-d6d934cb655a/
Malware family:
RedLine.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f82e5e6ba614/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f82e5e6ba614031d24cb1460149e658eb3b4b9b0372dda40989ea413feae185c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/321928/

Comments