Extracted

• • Target

    DRAFT199849-BILADING-8458886.exe

  • Size

    1.5MB

  • MD5

    f0b94cd08cddbffeafd2e96ca4cc5e3e

  • SHA1

    50fe4df2e4974447a23baa0007aec7e81db2fa29

  • SHA256

    fa2e0066a72e409c12bb2f71eb282d8feb9cf7a956ed51a22a69c4a43c7a9dba

  • SHA512

    6c489f64857d494826c0fe504b7351047692f10cecea2795c1b6d8dd246d3ed7742577511f8e18caaf8ad8d7e949f5e6f92bf042bae12e7d772684ddbb51ed12

  • SSDEEP

    24576:8AOcZ+2JfN+Owq85kORkr+5fvQz6TzGouZuvhHbyC1BQrXAz3fJzQsZx4Zig:q5KUOwq85kikQvQOvvhuCkAz3fBQsZOj

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2