Extracted

• • Target

    abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118

  • Size

    6.5MB

  • MD5

    abaf1bf2dc6afd728dd51a10546d92cc

  • SHA1

    9dd27a0f776631f5811b5320e8b8c10446332b4e

  • SHA256

    4a65fc918ed0e20b294eb7474795f7a47899ecc14cee273322d3c68691a31648

  • SHA512

    f06cafde915e9800ef7db2afcdbcb6842f5bff4c65636815cabd0933f5c9c6c465dc7c9085a3aa4ef18d7bd6dcd6425f3633231b30fa4676f01711c4170eafdc

  • SSDEEP

    196608:9An9naf2sp80b0ArW4+NtkqRoP48s+Kktnv/:29Gza0Tt8kpP41+Kk

  Score

  10^/10

  wshratexecutionpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • WSHRAT payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2