Extracted

• • Target

    Pending_Invoice_Bank_Details_XLSX.js

  • Size

    616KB

  • MD5

    146543805fbb1a73135ca00f2899118f

  • SHA1

    f13878fd653431ab505ee248abe931880faab471

  • SHA256

    b4420793217d8bd201ba7f61b863873c7ec1befa308d9eea52b90cb2cbc4d1a9

  • SHA512

    efad864edb7dff50ef656481de3664f0752449ffc4b3c4cebc4fd5fe3b241c663c2948eb6c93c20e68b1ffd0a19061b8200c2a779bf55a6746827aa9b23a53a0

  • SSDEEP

    12288:OYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEM+:OYeIrWr/qRigAyX/kngXFbjTLvaH28n1

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2