Extracted

• • Target
    0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba
  • Size 6.4MB
  • SHA256 0b8be08e9fc3281203f8eaa1e932edbc85dd7d0c119b5181013942ad9c0583ba
  • MD5 5b679ac606cb3cc789c7fefc0ce73aa3
  • SHA1 08d086a403aa3531560336b09696763f892b054e
  • SHA512 5a470e2ab878379d2884dbf68d16c035849a33b07187ee93219d07f097e38b9835b9ff9f5b05943385d3f622f923b0e091e0f1f1775681dc4ba9a2469297f474
  • MD5 SHA1 SHA512

  Score

  10^/10

  wshratpersistencesuricatatrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT Payload

  • suricata: ET MALWARE WSHRAT CnC Checkin

    suricata: ET MALWARE WSHRAT CnC Checkin

    suricata

  • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2