Extracted

• • Target

    Purcahse_Order_30032023.vbs

  • Size

    271KB

  • MD5

    f556c56f63b7ef7b55cc73e573dd5204

  • SHA1

    6d3f5dc51b47777a14ce4b534c0f8749c2a13771

  • SHA256

    5d3e88aef97b82e659730321469ba7cea252d82389999871927f218a0dd6ac26

  • SHA512

    d2d04d07297d418dcd535c989869828b542d82bce82c20afdd064a59a9c3215127d316f394f2d92ffa2bc2bd8f0987840f3c3507d9aa8ab6e23d7f33a51eb758

  • SSDEEP

    768:LqE2qlap4KjQwNCnw3CtD59yHs10wVR3wKwEBTH1dHFDE:qf

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2