Extracted

• • Target

    ORDER230322.vbs

  • Size

    250KB

  • MD5

    2a76503660d140d0aa08bd758cb9c29c

  • SHA1

    55c1ba23321e11c0298450fb9dfa1ccebdea2d86

  • SHA256

    5f0329e51f347ca573ea69cd865bb03d0526d9e9e91477a4502a9fe35c3fbddf

  • SHA512

    f50da5213bf53b02199a2d3c5c8d06643315bd939b5047bfe44a904b8cb45be22793155f9055e9529c3ebd1861d14ae39528a9914e841ab3a91c6540c29b7390

  • SSDEEP

    768:19C8cPTeUGV5V4ky1rHHPskYROOowLXMJuzHHMH+HCo/LiGi2tl33xRXC:yR

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2