Extracted

Extracted

• • Target

    ORDER-018654-002504.js

  • Size

    6KB

  • MD5

    7352df5a14aecba54ac07136a27f96e6

  • SHA1

    44a686b3acdeae3d0c704d8dc2618d31029c2fee

  • SHA256

    60667b8d0b8ed46c3b023dfec70fad2f24cb4bdd15060db90e6176e67ca09c76

  • SHA512

    4b89b36c30d5f3d0482300d5726d7eea8a283a930f2e959f9b15d37a04ba69a96ab9038da6159014b312e32f3d9cf8556369542efc16b72e7cb1b59feb60587b

  • SSDEEP

    96:wxjwyH4VwotBhKk5a7wof1AwwyHkps6iAaqg3BBi7o2XqwyH5RTuptSupKqupcak:1o9XUGPIYGiU8gh

  Score

  10^/10

  asyncratwshratdefaultdiscoveryexecutionpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1