Extracted

Extracted

• • Target

    ACCORD POUR COMMISSION A PRELEVER.PDF.vbs

  • Size

    246KB

  • MD5

    6b23cda6ddc86713d63e5b6bb853a909

  • SHA1

    7c12556e23a5b283846572fc9a1d70b01d306c1d

  • SHA256

    3cdadd4d8492cfe342f9f74529566ed6c1b451ba669509b59ffaf2965bce0750

  • SHA512

    9bd88a406202b539ec6cfb271c7c02b0ac2659d3c925aed20d1680d919f841fbef89566d33f29cca2fd1ebd5641b5a7ee17562eaa5dce447f89256cc470f1eeb

  • SSDEEP

    3072:aUo5/dXbshimRExcL2RXdoAhhI/Q7fgv1fJ5N3+OKFX8bQrzEbM0TC1I+M8IqeCa:arjPmR96gAjI4S1+ybAIA9jdye9Bi

  Score

  10^/10

  strratwshratpersistencestealertrojan

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2