Extracted

• • Target

    PurchaseOrder.vbs

  • Size

    260KB

  • MD5

    2ff3bce5c3e24a9a66ed42b49c3da68d

  • SHA1

    ca5506d9d30e0690d3cc023fafd524e09145ae83

  • SHA256

    7287f5e59370b51b2fa62b837ef11e5b7c37703151227c2fee01feaf04836fce

  • SHA512

    675956065410bc169900d5b2f7e5cc93c3499c222e3bb4cf83a578413a66fb9fdc0dad3f0af2a8fcefddcf178d6709f8e6efedea8a4bd6e25337026172706b85

  • SSDEEP

    768:Uwh+I+2b4WelZTvQYeXbxbYvEl2C9v0s0kdj57L3bK:Uwq7

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2