Extracted

Extracted

• • Target
    wp.vbs
  • Size 1.8MB
  • SHA256 2353f9efd1b2723bdf95000197beff7664633dccf157d36b85c8b136bd955aa3
  • MD5 4a4788023bf34677a863abe29107fb05
  • SHA1 ae30060cc132935e2454d250a64294efd2e589d0
  • SHA512 79bafae8f56b5edaed3a4cee69b44fd97475dfcde25237ddc4967ff3ee17bd20fa5b8bb34f8a9e0822418df786281405b18366025fc73ed0f0c2a063596cab57
  • SSDEEP 24576:shrG4rfKPn762lWXTN3OAVjUNGwwFdQiKbO4BfSSWWBF:v4rr9lfVjOGdGd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  oct-13crypterdiscoveryexecutionasyncratdarktortillawshratloaderpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Darktortilla family

    darktortilla

  • Detects Darktortilla crypter.

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Wshrat family

    wshrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2