Extracted

• • Target

    ORDER-240507-2789FT.js

  • Size

    8KB

  • MD5

    2a60755d218ae24e20471575bfd88b60

  • SHA1

    3096b50ad0794588b64c5e38880f5d1bf17fe699

  • SHA256

    427b7d14d7b35fce4320a1fdaa5afb6df6698b536322a937b0d838e0281db20b

  • SHA512

    a72dba3c3110dfdbec8556cf40043c63b36578765de51af9e446f75346d36f65643e66ddc0d3728a1b6b83ba4dbbe118e2f0bef0c9a28644f66b75c420c66506

  • SSDEEP

    192:GcEBLu9pDcEBocEBgBcKbWJMeMjrGPFYiaWcEBalN6u9pDcEBwX5J+PT6cEBhAPx:G4

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2