Extracted

• • Target

    Tax Returns of R48_765.js

  • Size

    957KB

  • MD5

    0f597e6821a29bc87b36222f08eff311

  • SHA1

    e7f24cd04de9b92c013d71d3de526461cfb33c91

  • SHA256

    df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028

  • SHA512

    693ed1331f7f048789c11bc661949519149c43e3a76b3b600a1990f74763500a6b4a5efb532921bcdb58b27f3a136af9ba63e2e1dce4094fe078076d0073f1a7

  • SSDEEP

    6144:QQ5C90ha3hcY0c5OyZD5i8frkU+uKCbbBGZs3xh527wIy+6Y16vLKdYoiAL1Xl4R:TKF

  Score

  10^/10

  wshratexecutiontrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1