Extracted

• • Target

    ORDER-230588A_List.vbs

  • Size

    231KB

  • MD5

    53d2c4e0ef3a0bd2bd51b646451da910

  • SHA1

    00af8c737918e10fcc2d7c40fa5f26426fa55a54

  • SHA256

    ea6b090afd399e4a167cb662c3dca238973dc92d83f248f5cff458c98872ce05

  • SHA512

    767e57221483f1a82f3f3fb9315e54b44a6dc532abe60ffa623dcdbdbb9e60a7683f7a9e5cd560f0ee30edfd5201e8e685a32ac3ac0ed36a35ce78f125771b73

  • SSDEEP

    384:iX/ILQLDsih5+Y/j/YTHOUueJnJTYN/gsyENK7N7+oLR7S7UHjUioqafx42HQLwg:uDD/LvRu3u8bX

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2