General

  • Target

    ORDER-2420588BC.tar

  • Size

    767B

  • Sample

    240521-m8j9csbc92

  • MD5

    2dde06d03b6cc18e145c7b952cbcd6b5

  • SHA1

    935aa877ff548008ec55574e608775fcd414d3ce

  • SHA256

    904433a46132966e07349beec0e6896e90594e316251c763710d848b1b8139c7

  • SHA512

    b2966640e360a2006ad5baa54a8447709d1cc29df2348c2432db81ceab610454718707b41047f177b1830019235555376888bf7d8dfe318584ea0bd515affbd8

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Targets

    • Target

      ORDER-2420588BC.js

    • Size

      7KB

    • MD5

      639127541b99347b61d5081b9ba9bc70

    • SHA1

      0c9360f998333030732704b4c4aede39ed7aeb8e

    • SHA256

      7e66f9c9c8dbbd79ea3e3a11dc7e902897ffa2bac730d1df3db8e12f09c44722

    • SHA512

      5d36c115a795494466a1875e843a5d548c2393e3a5a0f05f9356644604e73b43c3ddfcacd12198bed51917e82c45dfc3254d966c4b42d877b1812594a4863a17

    • SSDEEP

      192:zxlLQMrx8j+GvF78g89vP8sF7GEMv1j+GvF75Sdn1dPE31dPT662S+KQj+GvF73z:zxlLQMrx8j+GvF78g89vP8sF7zMv1j+B

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks