Extracted

• • Target

    CcxGQ.vbs

  • Size

    180KB

  • MD5

    c30c220229f3395c538e0008155881d9

  • SHA1

    54920b4a6da2ef1510dd619c41fabe4f9c104a04

  • SHA256

    b74e920938d79ce4669f94d803d10d19c2330b458130b91b6c8f9f41720f8cfe

  • SHA512

    45e7dfa45cf74617abc7a3a6d2b6d47f5548ff4ae57da60efad1a2b445848329cf379c83935f61285187b7eb6c2902c1e9b6d7d3043f0c9735349761049837f9

  • SSDEEP

    3072:6Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:6Ag8xSQmshISeWmM6iRC3eGKoAklgF28

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2