Extracted

• • Target

    6e23d208c9821f239e6ad6c52018a201e0a53842c3885b0aa4017c01518bd247.vbs

  • Size

    255KB

  • MD5

    82190aff405aa674adf49568649fe52b

  • SHA1

    966d1fa684290305b77cebad19f70ebedee66f3e

  • SHA256

    6e23d208c9821f239e6ad6c52018a201e0a53842c3885b0aa4017c01518bd247

  • SHA512

    de9a038defd43e12df8ee0b53cae2632408fc79a67c9340213d1c2d71436b41acbdb6d1feb16ee96f769cf629ca8e89c289d406265bb3081614288aa9d879d8b

  • SSDEEP

    768:9+i+03whqCx8CG5CsJRxhcxSLeK5BpmamOD5Z3rxRQ:+j

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2