Extracted

• • Target

    Order-Specification-Copy.js

  • Size

    7KB

  • MD5

    b9041797ab6d337c79b7fe365997b228

  • SHA1

    32a6eec778a00395b34e9afcb1ec27e7d74a530a

  • SHA256

    105d218c770d9b297c4dbc6b7b1e176aee64a4766fd8fb894dd9e0a84d51a38c

  • SHA512

    cfcf8c2d22d9117f969274bed3e74b73f6f3c6870380263fa912db43c18c3f9bd5ce5582d02bca70304fffaa94e3a608902880b5299e76dbb16037c12439eede

  • SSDEEP

    192:bwvNEwkwEC1iAwYNEw7HwHrjwMNEwZwOXNEwMynlbkP:bw1EwkwEC1iAwMEw7HwHrjwwEwZwYEwU

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2