Houdini

Aliases: Hworm, Jenxcus, Kognito, Njw0rm, WSHRAT, dinihou, dunihi, WSHRat, Houdini, Dunihi

First seen
2013-01-01 00:00:00
Malware type
rat
Family
Malware family
Related IoCs
215 (189 malicious)
Last IoC activity
2026-10-18 00:38:56
Profile updated
2026-07-07 12:45:43

Targeted industries: government-and-public-sector financial-services technology-and-telecommunications

Context

Houdini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an .exe but started being spamvertized or downloaded by other malware directly as .vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.

Detection coverage

  • 6 YARA rules

Detection rules

  • DITEKSHEN_MALWARE_Win_Houdiniconfig (yara-rule)
  • SECUINFRA_DROPPER_WSHRAT_Stage_1 (yara-rule)
  • SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_Usage (yara-rule)
  • DITEKSHEN_MALWARE_Win_Wshratplugin (yara-rule)
  • DITEKSHEN_MALWARE_Win_WSHRATJS (yara-rule)
  • SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 (yara-rule)

Reports & references

  • vectra.ai — Moonlight Middle East Targeted Attacks (report)
  • deepinstinct.com — Understanding The Windows Javascript Threat Landscape (report)
  • ESET — Eset Threat Report Q22020 (report)
  • about.fb.com — Taking Action Against Hackers In Palestine (report)
  • lab52.io — Wirte Group Attacking The Middle East (report)
  • blogs.360.cn — Apt C 44 (report)
  • mp.weixin.qq.com — Gwoirnplvqx761Lw8X S5G (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Houdini (report)
  • youtube.com — Watch (report)
  • Palo Alto Unit 42 — Unit42 Houdinis Magic Reappearance (report)
  • youtube.com — Watch (report)
  • cofense.com — Houdini Worm Transformed New Phishing Attack (report)
  • myonlinesecurity.co.uk — More Agenttesla Keylogger And Nanocore Rat In One Bundle (report)
  • binarydefense.com — Revenge Is A Dish Best Served Obfuscated (report)
  • github.com — Wsh Rat.Md (report)
  • blogs.360.cn — Analysis Of Apt C 37 (report)
  • Mandiant — Now You See Me H Worm By Houdini (report)
  • isc.sans.edu — 28746 (report)
  • blog.morphisec.com — Hworm Houdini Aka Njrat (report)
  • cybersecurity.att.com — Alien Labs 2019 Analysis Of Threat Groups Molerats And Apt C 37 (report)
  • cadosecurity.com — Threat Group Uses Voice Changing Software In Espionage Attempt (report)
  • yoroi.company — Threatening Within Budget How Wsh Rat Is Abused By Cyber Crooks (report)
  • threatresearch.ext.hp.com — Javascript Malware Dispensing Rats Into The Wild (report)
  • threatpost.com — 178422 (report)
  • Cisco Talos — Operation Layover How We Tracked Attack (report)

External references