• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 19, 2023
Rewterz Threat Advisory – CVE-2023-20057 – Cisco Email Security Appliance Vulnerability
January 19, 2023

Rewterz Threat Alert – WSHRAT aka Houdini – Active IOCs

January 19, 2023

Severity

High

Analysis Summary

WSHRAT, also known as “Windows Script Host Remote Administration Tool,” is a type of malware that allows a hacker to remotely access and control a victim’s computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim’s computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim’s machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.

Impact

  • Unauthorized Access
  • Remote command execution
  • Theft of Sensitive Information

Indicators of Compromise

MD5

  • 46517b469ec589b249fe1990c0c460d9
  • a2c40a28f05614c3d68c9c9727fa9584
  • bc83816244612cf692c88784bf39314e
  • b743d8c6adca54da12b0db7919c27a90

SHA-256

  • 6f4db9c0b9d6190016964bf3916c3f3a5b8f600ea4ed25955ddce5a45166bc0d
  • 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
  • f6cf56fadb9bc380881e8d653e2a9cbca6dd145d66b24b5d61fc8769fb45f12e
  • f2fd0e6165a227c6cdb08825ed6dc2d93c03a9440b54b1551b01c06611c470cb

SHA-1

  • d5e3e212edfff00ff973a1cee17a8029364b87c6
  • c9d7c014564072d2ea951ede6718632c20a5cd48
  • f2b0aebbf7668f78344bcf2c5c6c739b0bdb4152
  • 8f655cf64202816cc6f3f6bc9fb31fe654794947

Remediation

  • Block all threat indicators at your respective controls.
  • Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
  • Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
  • Patch and upgrade any platforms and software timely and make it into a standard security policy.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.