Extracted

• • Target

    fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05.js

  • Size

    7KB

  • MD5

    8a006c1466998c2bde5fa110296bf4da

  • SHA1

    38f5819efe2bfece434ff9de7ce327ad1dab920a

  • SHA256

    fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05

  • SHA512

    f90be849f383d9919c8463b4041d1e89a4de5e47cf9ef1dcb21f8af0d326857ce45e75c7100aed1c217b885a077001cfa50bb7489144f5f010e84b20c3d19ece

  • SSDEEP

    96:p8KvZU3TRRkyPWXsy7jZRZcmq74qe0tJLgy0c15Q:rsTRAL/ure0tFgc8

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2