Extracted

• • Target

    ORDER-17886.vbs

  • Size

    112KB

  • MD5

    6aaf489923e41a6a48c3c70bd33763d6

  • SHA1

    7bfb6ea711609aad62819faefe54cb4ee207b670

  • SHA256

    61aea0e09f6bf0722ce9d516032d8d8dcc3e1a262a8a7c622f81158c12d55435

  • SHA512

    3335601dbe6dd6b53e78895c3fdc87e49962ad8653fc04d8b2ac8a215a5cc25c3e18871c25639f42b161fb3d01bcf5611a609a79385bfdc920236a1c8790c98f

  • SSDEEP

    1536:AdkYPxC2uPxC2JPxC2iPxC2cUOxk5eRHUH5:Adk98

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2