Extracted

• • Target

    ORDER432023.vbs

  • Size

    218KB

  • MD5

    6ecd1b4c44ebec3bb195abc6e0aeb1fc

  • SHA1

    d09b365dc98d35e3e53e49503184f38aa9efd9b5

  • SHA256

    9dfca9429d741fb4b39d97c4d48e4c542193cc68930faead1c77e74f9bf3678f

  • SHA512

    8974df412ee71fa4a54a702038bbcf45fa53ad439f8c8dfde84e3b15857f99560fbca44fd101fb13e649b647e888cf0fd0945fd83389ffe0f6c75a424baa3b0a

  • SSDEEP

    768:uYcgYP1Tsg0HlHsf6I7j3nS3ftCSrCURr4n+xPJOxkvsWssnZ1BWKsnCWKsnSRQz:Aj

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2