Extracted

• • Target

    01313c486b99a572a9dbcbc3e01d414f11624d4e9b813a825f962b5ce66fcf64.vbs

  • Size

    230KB

  • MD5

    dfaa0731635b4e0867fb1a5b00f97cd4

  • SHA1

    0c0723a3447aa571afb33db576421a4af2dc8b86

  • SHA256

    01313c486b99a572a9dbcbc3e01d414f11624d4e9b813a825f962b5ce66fcf64

  • SHA512

    093af630e4ef2ad24ebfc088af53e5f6b6c9c88f51b6075aace72d9ce4a1de89d6825ace40eb23d7ae6c22900d1e6db04aee1544be4a701ed0c3980109fb326c

  • SSDEEP

    768:HxeMsGDC5m7QRcs7Gbs9GNjfN4Jxw9qOlFOeO2rlznJfjc:2J

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2