Extracted

• • Target

    Tax Returns of R48,765.js

  • Size

    1.0MB

  • MD5

    511ba3ec38b7b845f1b7406686a30d0e

  • SHA1

    e9a6d7f6dba313a8cf19809d78bb2a4a3ae14056

  • SHA256

    348ad8d4b2ad2379dafa00853c8c9069b438f7121f31475ec6b0ecdca8636353

  • SHA512

    fc40bc304cbd47de0c792bf0d57f9769da09eea7df8c3ebe67582a403715e67e70d59e77c8dc3a1e29429a136297af619d7ba9fb5b1c348f76f138e89057f788

  • SSDEEP

    3072:MQOYUQuE6HMWYiKuVVDGnCpsFpx0iu0cKUQbStdj7:MQOwuE6FYinVVDGnCpKpx0XeStdn

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2