Overview

overview

10

Static

static

10

6094df1228...9c5.js

windows7-x64

10

6094df1228...9c5.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6094df12286a36fb1428afc89e3c19c5

  • Size

    123KB

  • Sample

    240116-w7nptshdd6

  • MD5

    6094df12286a36fb1428afc89e3c19c5

  • SHA1

    e6f25d74194e1482fd597def62f0ae3ba48f9760

  • SHA256

    0d233c96aa7f53cec4c2f23cec481e7bbfa19995b67c997f7edb94afe8cca8d9

  • SHA512

    04a75076a5318730bb998e52de1403d41674f04d9c37cb28f096ff0c60da302f65a58ebbe224d74b3d22eed1d80b82c074bf06061fe31c0566f24ebffde28a0e

  • SSDEEP

    1536:q9mx0dB/va/w/XJgZLyjw7aj+ovdff991AuPR+YAhFgG99W+2QSEooATaRa:onB/nRgZzcVfn/PROFPAeRa

Score
10/10
wshratpersistencetrojan

Malware Config

Targets

    • Target

      6094df12286a36fb1428afc89e3c19c5

    • Size

      123KB

    • MD5

      6094df12286a36fb1428afc89e3c19c5

    • SHA1

      e6f25d74194e1482fd597def62f0ae3ba48f9760

    • SHA256

      0d233c96aa7f53cec4c2f23cec481e7bbfa19995b67c997f7edb94afe8cca8d9

    • SHA512

      04a75076a5318730bb998e52de1403d41674f04d9c37cb28f096ff0c60da302f65a58ebbe224d74b3d22eed1d80b82c074bf06061fe31c0566f24ebffde28a0e

    • SSDEEP

      1536:q9mx0dB/va/w/XJgZLyjw7aj+ovdff991AuPR+YAhFgG99W+2QSEooATaRa:onB/nRgZzcVfn/PROFPAeRa

    Score
    10/10
    wshratpersistencetrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • WSHRAT payload

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks