Extracted

• • Target
    Remittance advice payment notification as of.exe
  • Size 766KB
  • SHA256 9f11277408508861dee8aeef598cbee2af8d13b0e85c65fd5ec96cf5062e25fd
  • MD5 74d0eabf20cd753bef0fab28cc9930cd
  • SHA1 131c5dce13675994a53a3f68e5d6ad5b1fbe94e8
  • SHA512 a52755cf9036da24e4da410eca6549490696e65b2b4f8225ea1d19ce0ea36f196611c7526621abc472d952bd606158d01123df351e07122feb7fdb8009f02bae
  • SSDEEP 12288:/biQ2pSTPH3IkhjygJH2nzhXJXEQe3Xy3PiAo/LDRJkOBRo:/biQ2pgPjygk/EJaaA0L3kP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2