Extracted

• • Target
    DOC-0026819-6896ATC.DOCX.vbs
  • Size 676KB
  • SHA256 24cca7ccaf73871a42e0c3d3631ab2e7d6b6c26bc29cd0481fd01582425acd5e
  • MD5 8d895e8ce727c46cb8c6ed68d88a5b96
  • SHA1 68f90c9e1ea87105b4ae001f1d7401e72085526d
  • SHA512 f25643e770a6fc1b1493ad59c3156a8d3a50e699157b077d3d4a183ffac419226bcebfb52bd1510794fd14dad2144a69adcf491d6bb25d04ad41e3ed43527fba
  • SSDEEP 3072:3eWPJB1gtayRueMGizgMie+cOxvhct/8GqEW24VmL:OWxB1gtaygeM3zVDDdEZQ
  • TLSH
    T190E4ED50FB6C2F2EE3EE120DF1AA833D33B1A98579C539AD59807824E4C7427E51E593
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionwshratpersistenceprivilege_escalationtrojan

  • Family: WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2