Extracted

• • Target

    wpp.vbs

  • Size

    257KB

  • MD5

    d87d4c42c10f332a96aa10ffb455f49d

  • SHA1

    c6167ce4e59f14ce826a50e8d32847101e5e9dc8

  • SHA256

    5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

  • SHA512

    d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

  • SSDEEP

    384:GWbSLcLgOioL0XHys4KJPlTkXZ64SAzu7t7Q0TDh7O74DJxWO0K6dBjcOXoxAFuR:GZ8BcmuMwg4

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2