Houdini

WSH RAT (A variant of H-Worm/Houdini) https://cofense.com/houdini-worm-transformed-new-phishing-attack

Samples from this attack came in the form of SFX files. The original filenames of these delivery files are related to political figures and groups in the Middle East and the Mediterranean.

As the script executes it first adds one of three startup methods which will execute the script on Windows startup: ... Startup task ( not implemented yet )

The script drops two other samples on the file system: C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\HUAqCSmCDP.js C:\Windows\System32\wscript.exe" "C:\Users\admin\AppData\Local\Temp\hworm.vbs

description = " Alerts on the decoded WSH RAT VBScript "

When executed each SFX file opens a decoy document, video, or URL, and eventually executes an Hworm payload in the background.

The other two files found along with this PDF at its arrival via phishing email have the exact same content (even same hash) in spite of having a different name: LIST OF AVAILABLE JOBS.js SALARY AND HIRING CONDITIONS.js This highly obfuscated JavaScript has the only purpose of dropping a second VBS script

As the script executes it first adds one of three startup methods which will execute the script on Windows startup: ... Startup task ( not implemented yet )

As the script executes it first adds one of three startup methods which will execute the script on Windows startup: Registry Run in HKCU Path : HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

As the script executes it first adds one of three startup methods which will execute the script on Windows startup: ... Startup task ( not implemented yet )

Using CallWindowProcW the script will jump to the RunPE shellcode and the shellcode will inject the file (FILE_DATA) into the host process.

As the script executes it first adds one of three startup methods which will execute the script on Windows startup: Registry Run in HKCU Path : HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

This highly obfuscated JavaScript has the only purpose of dropping a second VBS script... After deobfuscating the VBS script we could identify the malware sample as Houdini’s H-Worm , but preceded by an interesting line, still slightly obfuscated.

The original filenames of these delivery files are related to political figures and groups in the Middle East and the Mediterranean.

Using CallWindowProcW the script will jump to the RunPE shellcode and the shellcode will inject the file (FILE_DATA) into the host process.

It will then register DynamicWrapperX: regsvr32 . exe / I / S < filename_dynamic_wrapperx >

Following the installation of persistence, the script checks if the current environment is WOW64.

They also used BTMemoryModule to load DLLs from memory (without saving it on the disc).

File Manager : Provides the ability to list files and directories, delete, rename, and execute files, and upload or download files via TCP or HTTP

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

$ str_3 = " WSH Sdk for password recovery " ... $ str_4 = " wshlogs \\ recovered_password_email.log " ... $ str_10 = " Unable to automatically recover password "

It includes the string “new_houdini”, the mutex used by the implant, the name of the user, the operating system version, the version of the implant, and the name of the foreground process

It includes the string “new_houdini”, the mutex used by the implant, the name of the user, the operating system version, the version of the implant, and the name of the foreground process

Misc : Provides the ability to list processes or modules and kill running processes

It includes the string “new_houdini”, the mutex used by the implant, the name of the user, the operating system version, the version of the implant, and the name of the foreground process

File Manager : Provides the ability to list files and directories, delete, rename, and execute files

Following the installation of persistence, the script checks if the current environment is WOW64.

rule wsh_rat_rdp { ... description = " Alerts on the WSH RAT .NET RDP module " ... $ str_0 = " GET /open-rdp| " ... $ str_3 = " TakeShoot " ... }

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

Screenshot : Provides the ability to capture screenshots in JPEG/BMP formats

This new version of Hworm uses a mixed binary and ASCII protocol over TCP.

rule wsh_rat_reverse_proxy { ... description = " Alerts on the WSH RAT .NET reverse proxy module " ... $ str_2 = " WSH Reverse Proxy " ... }

Internet IO : Provides the ability to download and execute files from the internet.

The Hworm implants use a connect-back communication. This means the server (implant) connects back to the client (remotely controlling system).