Extracted

Extracted

• • Target

    wis2war.vbs

  • Size

    1.9MB

  • MD5

    72fab82acb233fa5b2d7aeb5cecf14bb

  • SHA1

    dd7e2daa860b045e8b683407ab653c75df13256a

  • SHA256

    35dd9286ed2d79a748a02cd32a9418e39a1b91d237f9ee67d2f305fc4b659f0b

  • SHA512

    534c935688b227edaa3b77ba95b3de95ae1cf34a8614e906986c8448c54a64a5c4811d3d5ff79ea232160722173370e0dc3ae3b157ed12d789848034a6479ed4

  • SSDEEP

    6144:MhFLSUbTzDvAaRZMF2nkKA3T7oB32XsPhY0/QSE2lGNpUoB+mZIS7/942c:ctxrPgwivYeSV4pR7/M

  Score

  10^/10

  warzoneratwshratinfostealerpersistenceratspywarestealertrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2