Extracted

• • Target

    ORDER-230531AS.vbs

  • Size

    9KB

  • MD5

    f1d9251929145c7232d1004d6bf309c5

  • SHA1

    f549e8742fe833551d57ef95900fb627921b8049

  • SHA256

    d81692de8fd3c96833905542934bb5c75fcdd5408c34f1406cca410b5fe6511c

  • SHA512

    e36be73daffafc58f790225829f7c3a717f94f8069b340f20175653d7416e2be7eda3cf39fc53c2a9b5c135d4c13aee4c3b6787bd84669c7d3c2a71e8be031cd

  • SSDEEP

    48:0Hd230PPDakG+biHd23gPxBl2akG+biHd23g0BXXakG+bgBP30PPDakG+3p3QxBJ:0Et0R3S6G

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2