Extracted

• • Target

    Tax Returns of R58,765.js

  • Size

    1.0MB

  • MD5

    33300fb747c6677625aa17d03e1010f3

  • SHA1

    b1bea456907b59a8182a0f01cc0e90f6e32e2779

  • SHA256

    cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35

  • SHA512

    3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764

  • SSDEEP

    6144:QQ7vErztQ9MZIUWrltWZV1+VJaMd5KVPb5emOJ62+ILfahP2CTLqO0EXZ9gsP7Ay:Te

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2