Rewterz Threat Advisory – CVE-2023-28076 – Dell CloudLink Vulnerability
May 18, 2023Rewterz Threat Advisory – CVE-2022-208640 – Cisco IOS XE ROM Monitor Vulnerabilities
May 18, 2023Rewterz Threat Advisory – CVE-2023-28076 – Dell CloudLink Vulnerability
May 18, 2023Rewterz Threat Advisory – CVE-2022-208640 – Cisco IOS XE ROM Monitor Vulnerabilities
May 18, 2023Severity
High
Analysis Summary
WSHRAT, also known as “Windows Script Host Remote Administration Tool,” is a type of malware that allows a hacker to remotely access and control a victim’s computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim’s computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim’s machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.
Impact
- Unauthorized Access
- Remote command execution
- Theft of Sensitive Information
Indicators of Compromise
MD5
- bcf2d9bfddeec58c7adfb7b85a6b179e
- 9f0fc6d60f36df9301170a6ec0d3f408
- f1a629154f159093b39b5f24c2413e5f
- a325d86c0dea86e974f3b09ec72f51b4
SHA-256
- acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657
- d295442674b1989fd65dea6a56081467424365f1c43ef9b74bff7fdb0f0c77ec
- ac6fc6a98a2a3944477156cab221166f6ee535d1a9d91c66171914091af24d34
- 851c015afd0f6a62fab6b5c1cfc532989085e2a96fefe5453f9e5c932e5b7803
SHA-1
- bf7c734f61cf2138932782a4a7c4873084168082
- 88ce1c32a1f7c18f34acf969e839ec4882e1428f
- 1036b4213b6ca79a86e00fc5b752fba43e3e6ad6
- 44d64605ae314225bca428613a10940586e1c7cc
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.