Extracted

• • Target

    proof of payment.js

  • Size

    941KB

  • MD5

    aefbde8b2feb2370f55b45f7c9fb33f8

  • SHA1

    5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de

  • SHA256

    a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c

  • SHA512

    8657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d

  • SSDEEP

    6144:MQPp6tU2vR4K1zzGxx29tUHwYwdetKadJjXqs4TSBdWHYa7iiRhqb0YDFL0jEhHb:Xj9

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2