Extracted

• • Target
    ORDER #26810-408529.XLS.vbs
  • Size 642KB
  • SHA256 c449d4a7e46b0848b39a041665cd4a2d6ca2e62c6fcad7cc745b92b01ad1e8c7
  • MD5 fcc362983318f26dd131fd9a915c63fc
  • SHA1 0d83267cf91584da3c52927ef45362d2f451e40c
  • SHA512 e8a788ff98d6a34a02f8de72bfcb3dfa884dca75307f5d2d6c0840b9a52b8555aedebc692e3ad851182bdc93fcff5bb970fbf76d6449063e5fa97b268da88437
  • SSDEEP 3072:MAOErT6v7M31oc9SACVgaEk/kDcbbWnvUhC8U6nT/Nk2JD/54T8VY64THfYSyyC4:ej1uxlkJm
  • TLSH
    T11CE4D0157BCE0DBC06C81B9FA23ED1ED93E3A14A6315386F686B70D8065B751DC2EA13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionwshratpersistenceprivilege_escalationtrojan

  • Family: WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2