Extracted

Extracted

Extracted

• • Target

    1c1f3eaf142c53480147c6e98cea4547

  • Size

    35KB

  • MD5

    1c1f3eaf142c53480147c6e98cea4547

  • SHA1

    92fbb5db21194832b830e4f5c44449c582138b50

  • SHA256

    42e299adf74331dc51950a2e0195d4f3230170358b362463cb1f113bc5755e6e

  • SHA512

    9a3a8bce2902a5be9c26bff283968161aca0237162f30a129c97fc65b9f52aa1cb724310ff9767967e1a6e360bf36432448df0e0fd542bdc0ab2477e254de540

  • SSDEEP

    384:A8iSUR/8det0Vyw/v+2iUP0jDeT1Jtl/+qTQ:i/quCTiy4eFU

  Score

  10^/10

  wshratpersistencetrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    23e8349880dde570473345c8b6ba8d94

  • Size

    75KB

  • MD5

    23e8349880dde570473345c8b6ba8d94

  • SHA1

    f496de8c8c54962429d53b59113470f7f20c82e3

  • SHA256

    a410b38594d20a9d7a66ea9f6c9838fd21d9916a27a999d13a82f52b456aba28

  • SHA512

    22018ecf84017431d9872235786ccb86d373f254b87badf7af86d0b70bce86af4f646a567888f17a2ab7722088e3e628e5d1f3175247d7a5a6358930375ef9d7

  • SSDEEP

    768:IXtnj8DgCxoXWfsJ3sWafL2zY7mTNxMS+twHDIxz99tIUt:IXd8HxoX13shfyzEmTp+aHDI3

  Score

  4^/10
  behavioral3behavioral4

• • Target

    5568d72be1bdebf9187261a24b3b324f

  • Size

    22KB

  • MD5

    5568d72be1bdebf9187261a24b3b324f

  • SHA1

    3729b13695a975366e1604e4fe31226591793823

  • SHA256

    2d9d77b0ab2b6c17fb16a1ce244f5d26fe9e688f6d7ee071fef18bee8e510737

  • SHA512

    a9befbe909487c68dd0d074066d3731db71985242fcb91a044f2410114372266b117b04ff71a51374f5cbda9842c2489197aebc3df102562e48eb408fe7f4389

  • SSDEEP

    384:oVzIiSXPf8dizrcdDbUVOwGAnbmbAecFekbKWVmNrxQ8khE1pE/a:G8iDiEdDgxmADekbKW8rky1p3

  Score

  1^/10
  behavioral5behavioral6

• • Target

    b8eedd013827b960eee4c0ae07ae5513

  • Size

    351KB

  • MD5

    b8eedd013827b960eee4c0ae07ae5513

  • SHA1

    7c8a8f64ff3367238e1d963d090a99c33677f011

  • SHA256

    8cfa170eb8271b0dc1e27b6792400161b0b8ab7ac49f4a88017bbcfe588d2d1f

  • SHA512

    78fcabd81473f8d51699a8e97e00e5cdfe107fbb3f8c3da3ceac6cf994d71fd280b5d24292947d293621c62adda0031fdc86dc609a75a237572b2203d237d7c0

  • SSDEEP

    6144:lW7fmlEskwkftlYoqDQX+++eUnG1Cg2KyS6g6ixSXprHMqy:lW7OKskwMlED+UnG1f2KySciMXprFy

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  behavioral7behavioral8

• • Target

    bcdf20e65445ed6bda794d958025e417

  • Size

    16KB

  • MD5

    bcdf20e65445ed6bda794d958025e417

  • SHA1

    6f3f1523627525c8efbb5bfe3e2f612d96801bef

  • SHA256

    332221ec47c7a4dd0296890e05e5c6647993dd1efdb139151e914e7cf22f9e65

  • SHA512

    9769842c9899b9ed2804a4390c40484908813035ca47f7b7ed6a7021337a91701b9daf9efb6ff94730d0b91f45fdd53631b3ac16e5cf1525008bedcfb5ac6210

  • SSDEEP

    384:/iutorSBqsqFxtJsUvWNxt/ZtNNkvJWObKo1nldRN:/XsUyFDJsUv8xllNkvPbKo1fD

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  behavioral10behavioral9

• • Target

    c82717259c368b69cb64572e74042c02

  • Size

    16KB

  • MD5

    c82717259c368b69cb64572e74042c02

  • SHA1

    2fc0ceb46caa5529bf3c7bce4c11793e1bfa45d3

  • SHA256

    5636b00a5c350d5f80d7654e256302f5c58b0d899fa800e8ff47ceb30b796732

  • SHA512

    af326ce518d9ec7a474cec903048e99d05608bfc4fe4966924c046773e43b6d5375742670fd241113e5f838710cb3595080e7cd6b61adec51d23f9f82b9f70e6

  • SSDEEP

    384:/iutbydI+IQLQDZaNxt/ZtNNsstAWObKo1n9EA:/XEIKCGxllNsstobKo19z

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  behavioral11behavioral12