Extracted

• • Target

    circolare.jar

  • Size

    222KB

  • MD5

    90e671a9d6318bd0b6c84f4d9a8405f7

  • SHA1

    ad4b30cf76a76745618a47eb71d2f97527af5f69

  • SHA256

    8ff89b316cfff559271ce4cb82584816829c79f0d4356358889284c822162c43

  • SHA512

    797aff0b8f08a9c22735fdf54b5f29b7a1312086eeb1f37937c52432a6d67532dcbaf6a3fbbbbcb92691b7d74dea129ba418b55f3b7633b24c3399ffe81e74c9

  Score

  10^/10

  wshratpersistencesuricatatrojanrattyrat

  • Ratty

    Ratty is an open source Java Remote Access Tool.

    trojanratratty

  • Ratty Rat Payload

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • suricata: ET MALWARE WSHRAT CnC Checkin

    suricata: ET MALWARE WSHRAT CnC Checkin

    suricata

  • suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2