Extracted

• • Target

    Equiptment_Order.vbs

  • Size

    234KB

  • MD5

    792c3b496734ad9ec371856e94f7cf35

  • SHA1

    9ad583739ca482bee22c74b56e018893aa960595

  • SHA256

    83afc9dc11c5db83f7f4f7f065a184b24ab8fa95d5500b390052eacd0c9b19ae

  • SHA512

    ae95386382a5e631e3c0f1834c77e8130cc1ea608165fa2a5bcc863ba82da1d1a49e4b3623296e0083ed053f680d6a3a0a06f70f317e57016879d43a0ffeb87d

  • SSDEEP

    768:BYaVSIsZ+XhEWr0AFYtAxY79BJWHkt06Dhp6y6ar7JFpt9u:lpx3

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2