Extracted

• • Target

    e860516a4fe33da6bc6476a4bfd4d1bf3eb154f649a52bd94c56b9bfd0b6360d.vbs

  • Size

    204KB

  • MD5

    c7f700216276af81e05bf12c7650f776

  • SHA1

    b2d4e89dfb652f73fbb0551c912682a0e38403c4

  • SHA256

    e860516a4fe33da6bc6476a4bfd4d1bf3eb154f649a52bd94c56b9bfd0b6360d

  • SHA512

    d8c6a27e07195579752ba17a67d7aae87ba269cde729fd837ed7e301ecf29adae6c8e607805756a06a2fe593fb6d0271b81cd2fde56eefa200e45281eb384d60

  • SSDEEP

    768:1LHYKIi81ZdqfsaBMKO5+rX5qJrgLS4JSr1NDFD6yaf6Nlr0TuNtrDuNqDuNm4uE:PflyR6XQHG

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2