Extracted

• • Target

    315061606e655e66db6ed9fa5bcbbac33e645c36da0a5730717973b8e323eb0d.vbs

  • Size

    289KB

  • MD5

    ba07223a894931526fd69b0c2b21221d

  • SHA1

    d7b63bb26abca39ef9c5ececa1a7bee5aa68cd15

  • SHA256

    315061606e655e66db6ed9fa5bcbbac33e645c36da0a5730717973b8e323eb0d

  • SHA512

    49611e025ccaa2f79072b3a1ab53b7d3fce2c61602ab6dc03dcf2fe9af862bdcdc35c9a3475c8a89ce99cadc89c20495730c048bd23248d644dee54b9a252799

  • SSDEEP

    384:d7QL+L0YoyzODjxosdoKF5vT8b8Qq6Pu7r7eOFDl7k7EDFh+2O0i99RVz8Jm0Jp1:4

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2