Extracted

• • Target

    DRAFT000-COPY-AND-SHIPPING-INVOICE.exe

  • Size

    1.1MB

  • MD5

    a44b84dfd8e6cdcb2a6825fc7e7b6c3e

  • SHA1

    a5221c8cbf6aa82ffb9871221502f45898cf539b

  • SHA256

    8b9ded7a4557b2ea2e7f64c50e8c87176191a5f426d052f2179e9bb6bbec8a4c

  • SHA512

    4c00bb582bb795dd6a38cd2f9b0d22192e8bf3ddad898ad86d54b8616b505c7d1136b58f157dcd90eec1dde2d5626225cf90858fb9d570e0709fcc1f1b59b712

  • SSDEEP

    24576:xTbBv5rUKmWX1kSerCiPFU/FrNdnp4RxRMa2tStaB2243:bBmGezFU/lnp4RN264g

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2