Extracted

• • Target

    proof of payment.js

  • Size

    909KB

  • MD5

    f27847fc20b30026c51e0af483b9615b

  • SHA1

    ca1efe5d18ed26eb754eea44e489139c6a99784e

  • SHA256

    85047c1d66a2f4fd7f179cf957b27ac2c8925c02d9e1ac6d2f47fd925ed85e6f

  • SHA512

    d639f9caf639f7ddc683c3d6d3baa9d5d238ab9ba2267cad015902ac31462d3b23a72d5f806a64a1b258088df5ced2d240e6f617dfbc3022ff5bebd8e482006e

  • SSDEEP

    6144:MQY6OtQp/eDJ+YQOd5NxqbQ83MJR5Sd6CLvx7IfiOiRYAZ7dFuylY4LDWnMn4Z8X:Xx

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2