Extracted

• • Target
    ORDER-0260730-006752.XLS.vbs
  • Size 639KB
  • SHA256 ae0c7cf73a0572469bd43b4f44bbe38b67ca35a45728c3f2a3cbb37662b44a8f
  • MD5 2f86763c1b7866f8bb08e261051eed44
  • SHA1 33919d9e56093496799ce3ca78e396eb3a58f1de
  • SHA512 8037d73191cf23d63ffdde74f215f493802ac067fff54cb36cd06b1f3e8780394d2e84efc7bc303618e35dbe40eef890064d2d244b3367b85adab21a83078399
  • SSDEEP 1536:2M6Cyeq57cy04+ceZOFSvTONu8gBeh+Fus++ZeDjP5ijvKejyXLNlmVq8ZB:dgcy0fzZOUv6Nvh+Fc+ZU5ijAp8v
  • TLSH
    T1F9D421684CF8342C2BB750DBD761887FC2BE0FD2815D515E63B4E89663CE6264E6B01E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionwshratpersistenceprivilege_escalationtrojan

  • Family: WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2