Extracted

• • Target

    ORDER-0023123.xls.vbs

  • Size

    230KB

  • MD5

    3d84d4f1b7e01480cfedafa0a34ac852

  • SHA1

    d9bdbd2cbb9a6747672e894647ef9f9b8ba84b94

  • SHA256

    7d45706129803b7677efbd92b0081d4e9f748604c6b190c3a042529ca3c83567

  • SHA512

    db84db87cce16e7ac2c72c60ca53bfaea80ae797e69b46fe873f13ef46ad0bf94a4d5a0f233b21453bc27005bb8ad640436d1d6dc3c08ab432a09720e78bde3d

  • SSDEEP

    384:vyOUTiLoLyUWMD+FVcu641tTm1n2Ers7Z7KY3D77OD7yDLJwSYOSlR1DhTerUdF4:vyO2BDrQR5

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2