Extracted

• • Target

    Purchase Order.js

  • Size

    535KB

  • MD5

    c8f59af1220efa3761728c04ed23322a

  • SHA1

    0e2d24b3e0ac2b2782b51cfe772b069268d514ed

  • SHA256

    852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97

  • SHA512

    c1faf78277158ac4611bd996018959891b2e80a9e7fb40eafe962ee1a98d1ae0ea6977a450209d72c2242be007a55352832a066c6609c6e7458a24be4421ebbe

  • SSDEEP

    384:t2WWKZWWAsg8gbToHWWWWWegHWWWWWztiGuYW+9j9suO5OOaCMOIYDr6LHDWTRtD:U8Y/

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2