Extracted

• • Target

    8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js

  • Size

    1.1MB

  • MD5

    0a72d138c339bdb349da3c3311ba42d9

  • SHA1

    39d2a2aa91b20890b205e3afbfa6998316264ad9

  • SHA256

    8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b

  • SHA512

    a51616d35b40731d825ea1ca6900f68cc3add16594f0aa63a565afdd3a756165c86aad3b52363352d7118ef7cc071c0255517837de9397ab8f447ea8f3b539e8

  • SSDEEP

    6144:MQJzmNEfYck5GmLcmSmA3ntOsAZelVWGNODAVnBk5ogYgtsY52PyeeZ4w5QVaQUU:X/7

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2