Overview

overview

10

Static

static

Rut.js

windows7_x64

10

Rut.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rut.js

  • Size

    412KB

  • Sample

    210421-vv5k2y6ecs

  • MD5

    b90b295157b57ba84dd525b8a0788cea

  • SHA1

    b58705476941038c5c0f4e0604c55276c8fc2096

  • SHA256

    6e348ed0aac3c01961f86af5fe843e1e1c5d2d977ea62eea7960efbb6a1c78fd

  • SHA512

    e291cd979fc2e75c308b4b98fe8f45e3b2ed1bb416825c0b52a588b6b2268695a5d6f4beed6f6817741368691d9acb98bad9229e9166bad023698d0393bd77b4

Score
10/10
wshratpersistencetrojan

Malware Config

Targets

    • Target

      Rut.js

    • Size

      412KB

    • MD5

      b90b295157b57ba84dd525b8a0788cea

    • SHA1

      b58705476941038c5c0f4e0604c55276c8fc2096

    • SHA256

      6e348ed0aac3c01961f86af5fe843e1e1c5d2d977ea62eea7960efbb6a1c78fd

    • SHA512

      e291cd979fc2e75c308b4b98fe8f45e3b2ed1bb416825c0b52a588b6b2268695a5d6f4beed6f6817741368691d9acb98bad9229e9166bad023698d0393bd77b4

    Score
    10/10
    wshratpersistencetrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks