HoudiniMalware
- dinihou
- dunihi
- hworm
- jenxcus
- kognito
- wshrat
Houdini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an.exe but started being spamvertized or downloaded by other malware directly as.vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1059.005Visual Basic
“This file contains a Visual Basic code, which performs a Base64-encoded PowerShell command to download payload from the public file storage system hxxps://m.put.re/Qm8He5E4.exe (SHA1: 523c5e0a1c9bc6d28f08500e96319571b57e4ba7) and stores it to the temp directory under the name “av…”
What the reports say
1 report, newest first · the exact sentence from each-
Kremlin RATs from Nigeria“The latter domain name brings to mind the WSH RAT, which is based on the Houdini code.”
Indicators in its reports
named in the reports above- crimea-kremlin.duckdns[.]orgin 1 report
- kremlin-afghan.duckdns[.]orgin 1 report
- kremlin-crimea.duckdns[.]orgin 1 report
- kremlin-turbo.duckdns[.]orgin 1 report
- 79.134.225[.]43in 1 report
- 95a6a416f682a9d2…01ce241b3366in 1 report
- hxxp://officeservicecorp[.]biz/rnp.txtin 1 report
- officeservicecorp[.]bizin 1 report
- office-service-tech[.]infoin 1 report
- ahjuric[.]siin 1 report
- a3816c37d0fbe26a…1ce5816039e7in 1 report
- wshsoft[.]companyin 1 report
- b42a3b8c6d53a28a…e9ca6e09cbcfin 1 report
- nitro-malwrhunterteams[.]comin 1 report
- office-data-labs[.]comin 1 report
- putin-malwrhunterteams[.]comin 1 report
- kremlin-malwrhunterteam[.]infoin 1 report
- skidware-malwrhunterteams[.]comin 1 report
- screw-malwrhunterteams[.]comin 1 report
- screw-malwrhunterteam[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.