Extracted

• • Target

    Request For Quotation.js

  • Size

    940KB

  • MD5

    78252a15f51c83f53b649437cfb4dd89

  • SHA1

    199691ba02706c385773a874fe6a6f6776d336dc

  • SHA256

    0677778651e6e33725cf6517a2bfa1fba1c7ca0bccde26b9c1408cd95b1741f9

  • SHA512

    87217894c79e6e17ef7c40ae3e8ab404fe5a7fc55028763bce93388cb9cc8c778536061ac97ddbc51bb5424a00f55d7362480706c04bfc7ceaa18fc70957c264

  • SSDEEP

    6144:XQsxuHg3waI+262g6Wl087udlFgnSTlWViJo4Q5SSAjMDbriPufIKeMuRg3B6oWM:gD4

  Score

  10^/10

  wshrattrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2