General

  • Target

    FV_ad2021MLltda.Docx.js

  • Size

    412KB

  • Sample

    210906-ty8mjabcd3

  • MD5

    d50491f6dbdf9bbd02d43e5f02ecc58d

  • SHA1

    1629504b95ec4975b243f480ec76b357f327e475

  • SHA256

    1e95c65bf0fb96be6f5cc0bd8a2672917a19eec232aa0367041e13e7fa3cb0f7

  • SHA512

    01edaa962f060b7c8cd72e9c5cf4365ea10725a3bb68f98dcc1712ad0915d551a69ef8cec12505fd8ca1f572a587c494f48abf815d822a134bcbcbf787e32fea

Malware Config

Targets

    • Target

      FV_ad2021MLltda.Docx.js

    • Size

      412KB

    • MD5

      d50491f6dbdf9bbd02d43e5f02ecc58d

    • SHA1

      1629504b95ec4975b243f480ec76b357f327e475

    • SHA256

      1e95c65bf0fb96be6f5cc0bd8a2672917a19eec232aa0367041e13e7fa3cb0f7

    • SHA512

      01edaa962f060b7c8cd72e9c5cf4365ea10725a3bb68f98dcc1712ad0915d551a69ef8cec12505fd8ca1f572a587c494f48abf815d822a134bcbcbf787e32fea

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Drops startup file

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks