Malware

Houdini RAT

Houdini RAT is a VBS-based remote access trojan used by the WIRTE threat actor in campaigns targeting Middle Eastern diplomatic and governmental entities. The malware is typically delivered via decoy documents in Arabic, themed around sensitive political or religious topics, and distributed as VBS files that open the decoy and execute the backdoor. Houdini RAT achieves persistence by copying itself to the APPDATA directory (as Update.vbs) and may use PowerShell for further payload execution, sometimes leveraging the Empire post-exploitation framework. Communication with C2 infrastructure occurs over unencrypted HTTP, with known C2 servers including 149.28.14[.]103:535 and domains such as micorsoft[.]store and office365-update[.]co. The malware's infection vector is unsophisticated but effective, with low initial detection rates by antivirus solutions. It is used to target diplomats, defense professionals, and law enforcement in Palestine, Saudi Arabia, Kuwait, and Gaza. Technical consistencies include base64-encoded decoy documents, typographical errors in function names, and the use of regsvr32.exe to execute PowerShell via SCT files. The infrastructure supporting Houdini RAT has shifted over time, including the use of Cloudflare for obfuscation and changes in C2 IP addresses.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Today we see this attack employed on a regular basis as part of widespread spam phishing campaigns

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

It allows to call functions exported by DLL libraries, in particular Windows API functions, from JScript and VBScript.

T1059.005Visual BasicEvidence1

The payload is a VBS file, which, in some cases, comes obfuscated or encoded with couple of layers.

T1574.001DLLEvidence1

DCOM_DATA is decoded and dropped to %temp% directory under the name “HOUDINI.BIN” and registered with regsvr32.exe.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

As the script executes, it drops a copy of itself into %appdata%Microsoft and gains persistence by editing the registry key: ‘ HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ’.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

The second stage is basically FILE_DATA which is injected to ‘msbuild.exe’ using LOADER_DATA (RunPE).

T1547.001Registry Run Keys / Startup FolderEvidence1

As the script executes, it drops a copy of itself into %appdata%Microsoft and gains persistence by editing the registry key: ‘ HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun ’.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The payload is a VBS file, which, in some cases, comes obfuscated or encoded with couple of layers.

T1055Process InjectionEvidence1

The second stage is basically FILE_DATA which is injected to ‘msbuild.exe’ using LOADER_DATA (RunPE).

T1497.001System ChecksEvidence1

The script checks whether the current environment is 64bit or not. If it is, it will execute the script with a 32-bit version of wscript.exe (from SysWOW64).

T1574.001DLLEvidence1

DCOM_DATA is decoded and dropped to %temp% directory under the name “HOUDINI.BIN” and registered with regsvr32.exe.

Discovery

1 technique

T1497.001System ChecksEvidence1

The script checks whether the current environment is 64bit or not. If it is, it will execute the script with a 32-bit version of wscript.exe (from SysWOW64).

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

“chroms.linkpc.net” – C2 address. “11” – Port.

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app1 year ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

lab52 blogNews

Apr 2, 2019

WIRTE Group attacking the Middle East

A remote access trojan (RAT) written in VBScript, used for remote control and data exfiltration. In this campaign, it was deployed by the WIRTE actor and used similar code and decoy document techniques as the group's custom VBS backdoor, indicating shared TTPs and likely the same operator.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Houdini RAT