Extracted

• • Target

    3ae5d683f6ac3b8e94046b04c87927de_JaffaCakes118

  • Size

    74KB

  • MD5

    3ae5d683f6ac3b8e94046b04c87927de

  • SHA1

    ace802d67421aabcf9ba3ba21632468f0265a2e2

  • SHA256

    c439374dede22f38738d6c955764542c1528956c4d4b773a4dec12a4f34dba44

  • SHA512

    ad3ba4ef0d4940b397d759edda1c45cffdeb1d684e04c787ba0be34dfd38e23ce375e4256237b33ec485f7f9b909277b3f6fd9e93d450087a31251abb164f7e3

  • SSDEEP

    1536:dScQPMz4GlHNvQYviFSD17fdN85bxYYhVfGAGnNUHORWR:ccQPM8GdNv6ERYLN7SNEKWR

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2