Extracted

• • Target

    ORDER-2420588BC.js

  • Size

    7KB

  • MD5

    639127541b99347b61d5081b9ba9bc70

  • SHA1

    0c9360f998333030732704b4c4aede39ed7aeb8e

  • SHA256

    7e66f9c9c8dbbd79ea3e3a11dc7e902897ffa2bac730d1df3db8e12f09c44722

  • SHA512

    5d36c115a795494466a1875e843a5d548c2393e3a5a0f05f9356644604e73b43c3ddfcacd12198bed51917e82c45dfc3254d966c4b42d877b1812594a4863a17

  • SSDEEP

    192:zxlLQMrx8j+GvF78g89vP8sF7GEMv1j+GvF75Sdn1dPE31dPT662S+KQj+GvF73z:zxlLQMrx8j+GvF78g89vP8sF7zMv1j+B

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1