wshrat | 8db1ee6decca485e9542f856906003d946b6244fb0bc44aa1a67528f65264fbe | Triage

Sharing

General

Target

8db1ee6decca485e9542f856906003d946b6244fb0bc44aa1a67528f65264fbe.zip
Size

117KB
Sample

250326-vvdhnay1fx
MD5

b040dc3b00f2d18fa4520c56bb736660
SHA1

1a04c3b8e9f1d2118dd5ec8214ffeebc1b3738ea
SHA256

8db1ee6decca485e9542f856906003d946b6244fb0bc44aa1a67528f65264fbe
SHA512

bcbc90b68a1005b15c944edff4d697613396ec60e4281fd3672f630385fc4d92bf17ccd2c3dd268295fa76c10f4e6e3f3ea8cbddc22b5be0d8271446276ed6ff
SSDEEP

3072:+oyG3C3Hyqv3bZVCccNmd6btdQ8ocQ8KU:XC3SUrZBcNmOemQ8KU

Score

10^/10

wshrat evasion execution persistence trojan

Malware Config

Targets

- Target
  
  7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js
- Size
  
  180KB
- MD5
  
  8040208fce8d913e8bfd30d079ff289b
- SHA1
  
  ef7a86909f86a1256d4dca3ae06f025eede7af5d
- SHA256
  
  7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68
- SHA512
  
  9009bac53eeb69271a232a2d5a7b8e941ac1baf3fd46f4aa186e674d0af471725c1ac9898def16e5caa3e37e8bcbe01369dd51e026d617c7f63b6243a7d96cc8
- SSDEEP
  
  3072:fp1gHeX3reXff6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:fp1gHeX3reXff6ZKwRY+cM24RCqeGKZR
Score

10^/10

wshrat evasion execution persistence trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- WSHRAT payload
- Wshrat family
  wshrat
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wshratevasionexecutionpersistencetrojan

behavioral2

wshratevasionexecutionpersistencetrojan