MalwareUsed by 1 actor

WSHRAT

WSHRAT is a script-based remote access Trojan targeting Windows systems, with VBScript and JScript implementations. It provides remote-access functionality, keylogging, RDP access, and reverse-proxy capabilities. Analyzed JScript variants implement these functions by decoding and executing embedded Base64-encoded .NET executables rather than relying solely on script logic. Their multistage execution chain uses encoded string arrays, placeholder substitution, and runtime evaluation to conceal executable code and hinder analysis. UAC bypass behavior has also been identified.

WSHRAT has been distributed through malicious email campaigns, including targeted spearphishing, and through the RATDispenser JavaScript loader. Discord-hosted payloads have also been used for its delivery. The financially motivated OPERA1ER threat actor deployed WSHRAT alongside other off-the-shelf remote access Trojans during campaigns in 2019–2020. Those campaigns primarily targeted African banks and financial services organizations, with mobile banking and telecommunications companies also among the group's targets.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

OPERA1ER

“We were able to observe the following payload families through campaigns in 2019 and 2020: NanoCore, H-Worm (Houdini Worm), WSH Rat, Remcos, Adwind or QNodeJS.”

via group ibgo.group-ib.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Attackers are looking to spread ransomware via these rooms and use the platforms to spread traditional malspam lures used to infect victims.

T1566.001Spearphishing AttachmentEvidence1

Malicious Attachments – Crafting deceptive messages to circumvent security measures.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Use of Malicious Scripts – Executing scripts (e.g., ‘.vbs’, ‘.msi’) to establish persistence.

T1059.005Visual BasicEvidence1

Afterwards, the VBScript file runs, which in turn downloads the malware payload.

T1059.007JavaScriptEvidence2

JavaScript in Malware – Leveraged for execution and persistence.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence1

figure 9 - UAC bypass and defense evasion technique

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Nowadays it is really a common thing for a malware to have a crypter packer, obfuscation and encryption to hide its code from analyst, evade AV detections , bypassed emulation and so on.

T1140Deobfuscate/Decode Files or InformationEvidence1

Once we replaced all the needed strings specially in variable "Array.prototype.tp_l1nk" which is base 64 encoded string of the next stager, we can decode it with our tool of choice.

T1218System Binary Proxy ExecutionEvidence1

I know there are so many way to de-obfuscate or analyze a malicious script like using the browser as a debugger, using AMSI technology , wscript.exe to trigger a debug mode "/X" to a target script file

Credential Access

1 technique

T1056.001KeyloggingEvidence1

After having the output of my script I understand some its feature function like RDP (), keylogger() and reverseproxy() better.

Collection

1 technique

T1056.001KeyloggingEvidence1

After having the output of my script I understand some its feature function like RDP (), keylogger() and reverseproxy() better.

Command and Control

1 technique

T1219Remote Access ToolsEvidence1

The final malware in this instance was Remcos, a commercially available RAT that is frequently used by attackers to gain unauthorized access to systems.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

ontinue blogNews

May 7, 2026

Ontinue Research on Black Basta Leaked Conversations

Remote access trojan referenced in the sample list, associated in this content with JavaScript delivery.

hp wolf threat researchNews

Nov 23, 2021

RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild | HP Wolf Security

A VBS RAT, also known as Houdini, with typical remote access trojan capabilities; one of the most frequently delivered payloads of RATDispenser.

tccontre blogNews

Aug 6, 2021

{"®eve®se": "Enginee®ing"} : There Is More Than Meets The Eye - Analyzing Obfuscated WSHRAT Script

A JavaScript-based remote access trojan analyzed as a multi-stage obfuscated loader. It uses string replacement, Base64 decoding, and hex-encoded string arrays to hide functionality, and contains features such as RDP, keylogging, and reverse proxy by decoding and executing embedded .NET payloads. The content also mentions UAC bypass and defense evasion techniques.

talos intelligence blogNews

Apr 7, 2021

Sowing Discord: Reaping the benefits of collaboration app abuse

Remote access trojan delivered via collaboration platforms (e.g., Discord).

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

WSHRAT