Extracted

• • Target

    759f0dc6c4d8fc56acb43050c51682340d083787a87e9aff6039e1741bcf4205.vbs

  • Size

    416KB

  • MD5

    fb16657ee3733e01e80549f41ec5d488

  • SHA1

    2a9ecb8808577e673ce20899d71d50ae7ecd9c5b

  • SHA256

    759f0dc6c4d8fc56acb43050c51682340d083787a87e9aff6039e1741bcf4205

  • SHA512

    65bf672a8f40cfc75b00e71ded566bd46ebe06a649d6eaf232e9d3ca5323b30d036233974e0a56c6f2ec2c6c106b93c13fa36ac66a7da18879c92e2544f0382f

  • SSDEEP

    768:TXG/Kiu/R/+6a5pdoEz41EN43HX3RYPi5AEvrpE4EiXd9bJRHG:11+D

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2