Extracted

• • Target

    Pending_Invoice_Bank_Details.html

  • Size

    10KB

  • MD5

    0def2826514ff6887d5a2a6cc7db4b5b

  • SHA1

    b6c964e67855f076e90fe5c339b02fa2fe423ddd

  • SHA256

    9eb2dc6ae95f6631e25eb8679a25eb330f1a7c463d3ccf31c53a6daa1346f007

  • SHA512

    cdfc1c5039bf03430d112109813915c89d6dd05592fc0b9a0e3d80e157ad7b404f55d0a1aaed2d1be1ffcdc1fb1c5513949ec713b9d22046cf9ca3de4f85d50a

  • SSDEEP

    192:/TO8OGVCARwH8izhrnV9fxRQdjSecSc6i0bKVC:/TBCARwcizhrnV9fxRQxSecStbKVC

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2