Multiple WordPress Plugins Vulnerabilities
May 7, 2024New Persistent macOS Spyware ‘Cuckoo’ Targets Arm and Intel Macs – Active IOCs
May 7, 2024Multiple WordPress Plugins Vulnerabilities
May 7, 2024New Persistent macOS Spyware ‘Cuckoo’ Targets Arm and Intel Macs – Active IOCs
May 7, 2024Severity
High
Analysis Summary
WSHRAT, also known as "Windows Script Host Remote Administration Tool," is a type of malware that allows a hacker to remotely access and control a victim's computer through the use of malicious scripts, typically written in JavaScript or VBScript. This malware is typically spread through phishing emails, social engineering tactics, or through the use of exploit kits on compromised websites. Once a victim's computer is infected with WSHRAT, threat actors can use it to steal sensitive information, install additional malware, or use the victim's machine as part of a botnet for various malicious activities. To protect against WSHRAT, it is recommended to keep your computer updated with the latest security patches, use anti-virus software, and be cautious when clicking on links or opening attachments from unknown sources.
Impact
- Unauthorized Access
- Remote Command Execution
- Sensitive Information Theft
Indicators of Compromise
MD5
- 2299cd103202899b48a32a317f58192d
- df7e2ec3ee72ab7a80d2542807ea0c25
- 146543805fbb1a73135ca00f2899118f
- a6397cdb9e01000e53c123893acad42c
- 8dcc2c7236870e00097d09cadc066b03
- 45ece63fd62550c00c23129d45acc6ae
SHA-256
- 2027db19e08f49cb365ca8523145ff5ce77bf4b4430075c3bf274f4a4f3f789b
- e8b589ab580205d0a3cf61367dc5e818aa2a7a90973b95de55502ff6c5853e27
- b4420793217d8bd201ba7f61b863873c7ec1befa308d9eea52b90cb2cbc4d1a9
- 010095c8ca094243c44f0d489b55dc1a132e0f776ab71e6bc221ff8c127a810b
- d968cf117419570bc67f57a2be52a648d2253346fd60489c06435fdbe518c61e
- 60413aef500d578efcf2ce776c02d9d6b29ec0d1070ea7d758b6c5a3544e7928
SHA1
- f813552dffb221b7cfaf356d571bf6468b9e58aa
- 21f70badfff73f0b55d417d08438236f3e7cfd52
- f13878fd653431ab505ee248abe931880faab471
- 6cd4fbdf9d806e21533c546e3aca996d20a611ba
- 2c9868c25000e2d7801dc9fd431d6ba99b694e16
- 428b9734401dbb1c71cbe84894be3ac54f7f8f0f
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets
- Patch and upgrade any platforms and software timely and make it into a standard security policy.