Extracted

Extracted

• • Target

    PurchaseOrder.XLS.js

  • Size

    7KB

  • MD5

    1cc985fc54d86c85a9fedc783ece93bf

  • SHA1

    25ec6c257f51023f42094cf74e748514369190cc

  • SHA256

    e3c938b4f4fe140677bb420c68b052b4473cfc1135b223871ade67706a3d16b3

  • SHA512

    7818e205750495df0c13687d0a2ee47306113478aa858af31dfbb3e2a30eebaf58c808d9810ca231708c70fd0089cc05f90595c3125bf4a1b87deb5510e70779

  • SSDEEP

    192:rrCbeo9//0bGiExYWySgU3Ub+k0OAaBvRMYRfuYbcZwulYp2h:m

  Score

  10^/10

  warzoneratwshratinfostealerpersistenceratspywarestealertrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2