Rewterz Threat Alert – WSHRAT aka Houdini – Active IOCs

Severity

High

Analysis Summary

WSHRAT, also known as “Windows Script Host Remote Administration Tool,” is a type of malware that allows a hacker to remotely access and control a victim’s computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim’s computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim’s machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.

Impact

• Unauthorized Access
• Remote command execution
• Theft of Sensitive Information

Indicators of Compromise

MD5

• f78a39cabfe10c50cbfa7fc702d40538
• ba07223a894931526fd69b0c2b21221d
• 8faf36edfae1ec0e8eccd3c562c03903
• 22e021e97b1606d6abdfaf275e3b5e17

SHA-256

• ea4bceb3df15541d335307a4c24db4829bcc7a0199900f89ba4a8cc55a7cf468
• 315061606e655e66db6ed9fa5bcbbac33e645c36da0a5730717973b8e323eb0d
• 1c546a6548beda639640ebfbb52abd5f6013c33500172cfccf0e8716c96bb196
• bf9732fc595f9164e52870fc95a4673fb5fddd7748003c392aeb8f8776eea077

SHA-1

• 0b2dcde43a772b4673c6658afa05fd23a9e25653
• d7b63bb26abca39ef9c5ececa1a7bee5aa68cd15
• 0c44c3c6291c67c4eae6e1f8238f098adaee1a32
• 4980e4db080a52d5c456c7bb4bc1190eb8bb3a0e

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.