Extracted

• • Target

    Request For Quotation.js

  • Size

    896KB

  • MD5

    7253f19b242503fad9a8b4e106d27318

  • SHA1

    58accce68dfd8de6e378956387dfbceb8f964287

  • SHA256

    6ec3e682fbbd0c23fb4e3a2c2b28f03431b90a88651d227ae3f33b6fadf507cf

  • SHA512

    780608f8217ead3565b9b395a79e436096b1db123842976a375cc7c5770d6fcc724465a45d55e6dfb75e78e139cd6a5ec0bb639a0e0488d3effbc9c3b6fb17b9

  • SSDEEP

    6144:QQLz4cW/pKERl7E9USsfl07aGvbEVyzNeez2V6M5uk5jrtnQ1RGlM9VIfSRIwIcw:T7X4oRVW+L40gqNbEMlp4

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2