March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Rhadamanthys Stealer – Active IOCs
February 24, 2023
Rewterz Threat Alert – BlackCat Ransomware – Active IOCs
February 24, 2023
Rewterz Threat Alert – Rhadamanthys Stealer – Active IOCs
February 24, 2023
Rewterz Threat Alert – BlackCat Ransomware – Active IOCs
February 24, 2023
Severity
High
Analysis Summary
WSHRAT, also known as “Windows Script Host Remote Administration Tool,” is a type of malware that allows a hacker to remotely access and control a victim’s computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim’s computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim’s machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.
Impact
- Unauthorized Access
- Remote command execution
- Theft of Sensitive Information
Indicators of Compromise
MD5
- 7c1b866122a8e513808e32caed12c6f6
- 6cf25c54bbf78ea413ad803fffe22b13
- 2e893ed360a5b3586ae13862a492652f
- 6aaf489923e41a6a48c3c70bd33763d6
- cabfb532b1a74b86c6e2bda9d2085079
SHA-256
- 6d492fc9630da1e571ef9953241ad9a594b7b702d7dfa033b06941d3b7f9f201
- 75f76d1f0ac721195b5521cf3ed4c980f757c0517046ecfdc24de3451852c67f
- ec20d0a098f22992a04e3b875996a6af49e023e929fea3e6192c7444fb80553f
- 61aea0e09f6bf0722ce9d516032d8d8dcc3e1a262a8a7c622f81158c12d55435
- 64271b2cc7849f1e9ea9d881f6014af70db7800dd86397437342b11ac6ed9d64
SHA-1
- fe31d17019b1faf1fa5a8c219bfbf1290d8c3423
- f0ff88f5a0279e5c36432c17551aeb22be1d156a
- 053d796519b37d69bf6650f92c5404ef9830ec43
- 7bfb6ea711609aad62819faefe54cb4ee207b670
- 076889ea3c5850677c67fad271028d717c21a37e
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Patch and upgrade any platforms and software timely and make it into a standard security policy.