YARA rules for WSHRAT
4 rules from 3 sources detect WSHRAT. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all WSHRAT rulesSearch rules
Yara Rule for WSH rat .NET packer of February 2021
MalwareSignature Base (Florian Roth / Nextron)· Yoroi Malware ZLab· 2021-03-09Detects WASHRAT
MalwareditekSHen detection· ditekSHen· 2020-11-06- SECUINFRA_DROPPER_WSHRAT_Stage_1Metadata only
Detects the first stage of WSHRAT as obfuscated JavaScript
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02 - SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageMetadata only
Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02