Overview

overview

10

Static

static

1

ORDER-230428.js

windows7-x64

10

ORDER-230428.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER-230428.pdf.z

  • Size

    9KB

  • Sample

    230429-rm2nqsdb2t

  • MD5

    a5390e1cfcb48d9172afa6624fec6757

  • SHA1

    0c8179765097c92c2920a2f69d49db83eef462cb

  • SHA256

    339a06ea8d91b3663bda121ecb5f027eb047f2c547cff834bc7de1c04eea00e5

  • SHA512

    d5625ef92ee4a32cd8efd279ef45cd36132135c5412619e08ab026cd18a0e114177aa633140470a8375c96212c556bc06f265ceba760556f7bc1ab06d3f4d0f0

  • SSDEEP

    192:IEYENrBydWq4bW+GFPzj9O8ptHNbbI3gJK+YjeeSEyb3GFUSiQTKWHdlzZ:lYAyQqEbGl9bttvIuKBmE+EUpQZHdlzZ

Score
10/10
wshratpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Targets

    • Target

      ORDER-230428.js

    • Size

      521KB

    • MD5

      678f7bc2963dfe7d00f80de5132f63af

    • SHA1

      b2f9383257887b902b25c7f24e1d6320cb88acea

    • SHA256

      749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6

    • SHA512

      9fc216681d1e1979cafd33b8c41f116dc99f0e859dd87ed2340e1d3609efc0f302c7c2215500f3bafc3f5b45003898facc55e0fd5c4c7f0097da04977abcb777

    • SSDEEP

      384:lilWWgNgxgygHWWWWW/IHWWWWWXgHBq8iOAwI4LuRu1kKMiIeBWSPSHv7rWektWW:d1H0Ef

    Score
    10/10
    wshratpersistencetrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks