Overview

overview

10

Static

static

Documento.PDF.js

windows7_x64

10

Documento.PDF.js

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Documento.PDF.js.zip
  • Size 84KB
  • Sample210806-e3avbbe4ka
  • SHA256 5e97f6fda0b360ee80bbf174a7fd063a3916c577d3e98d4b05024ef3dd304c51
  • MD5 SHA1 SHA512
Score
10/10
wshratpersistencesuricatatrojan

Malware Config

Targets

    • Target
      Documento.PDF.js
    • Size 673KB
    • SHA256 85e41bab0ec97c8110d96123d9c0d0c3431dbe4b388f5695baf5221e9d736718
    • MD5 SHA1 SHA512
    Score
    10/10
    wshratpersistencesuricatatrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • suricata: ET MALWARE WSHRAT CnC Checkin

      suricata: ET MALWARE WSHRAT CnC Checkin

      suricata

    • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1

      suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1

      suricata

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks