Extracted

• • Target

    Purchase_Order.vbs

  • Size

    216KB

  • MD5

    286fff39c1b94a7faea3275f7d32abfd

  • SHA1

    fc077b0bcef5f5c694cf913cd69081c5bcf23d82

  • SHA256

    98a77976e106ed9d665a7856da1371dd1e6e61cda4dd076cbb6f191c2f1e9ff6

  • SHA512

    e618504775f2e3a5a294a519d18868531c51822ae4377ec800ad5fb264aaa2c77bbb3e0dfbc3c5f812b6940e6e91131d1616b75239a9dd6f4c7ab4f55df3d2c3

  • SSDEEP

    384:dQiz8VURuMLULOnskUVyxn4eyY/3TmXSqEKk1x3D82nc8OmyGD0a9Yo4V4ShBBqn:18VURFqSXgNMeST

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2