Rewterz Threat Alert – WSHRAT aka Houdini – Active IOCs

Severity

High

Analysis Summary

WSHRAT, also known as “Windows Script Host Remote Administration Tool,” is a type of malware that allows a hacker to remotely access and control a victim’s computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim’s computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim’s machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.

Impact

• Unauthorized Access
• Remote command execution
• Theft of Sensitive Information

Indicators of Compromise

MD5

8ebbced4d3aebc154e8a98597e51eb05
d7d4bde73f37306d955f0bfb63a8d002
c5f00ad1e40b07a62d44a6e03856249f

SHA-256

2bd1aae7d100fbdd561aa9274431732b7b590246a724f43e81afe35b58a95f97
da924bd600bfab2b3d7647fadf31593747aac941e083856d8bcedaa021da4b7a
35059d9250ce74d1048175f7abea89b0946b57050e51e24b52dd1891a69064f6

SHA-1

571f6b27b54ea33889b4171a633e62ebed6199ac
843b86723b5c6113b1ab20756b98d3c8221db031
0254f337d817aaa6e7bb0ddaa8e03a02fef6814c

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.