MalwareUsed by 1 actor

WSH RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA2541

According to the researcher’s observations, AsyncRAT, NetWire, WSH RAT, and Parallax appears to be the group’s top favorites being pushed most often in malicious messages.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence3

WSH RAT (A variant of H-Worm/Houdini) https://cofense.com/houdini-worm-transformed-new-phishing-attack

T1566.001Spearphishing AttachmentEvidence1

Proofpoint notes that TA2541 has been consistent about its attack method, relying on malicious Microsoft Word documents to deliver a remote access tool (RAT).

T1566.002Spearphishing LinkEvidence1

Recently, though, the group switched from malicious attachments to linking to a payload hosted in cloud services such as Google Drive.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

In the next step, the adversary executes PowerShell into various Windows processes and looks for available security products by querying the Windows Management Instrumentation (WMI).

T1059.001PowerShellEvidence1

If executed, PowerShell pulls an executable from a text file hosted on various platforms such as Pastetext, Sharetext, and GitHub.

T1059.005Visual BasicEvidence2

Proofpoint observed this group using Google Drive URLs in emails that lead to an obfuscated Visual Basic Script (VBS) file.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

T1555Credentials from Password StoresEvidence1

$ str_3 = " WSH Sdk for password recovery " ... $ str_4 = " wshlogs \\ recovered_password_email.log " ... $ str_10 = " Unable to automatically recover password "

Discovery

1 technique

T1082System Information DiscoveryEvidence2

Then it tries to disable the built-in defenses and starts gathering system information before downloading the RAT payload on the compromised host.

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

rule wsh_rat_rdp { ... description = " Alerts on the WSH RAT .NET RDP module " ... $ str_0 = " GET /open-rdp| " ... $ str_3 = " TakeShoot " ... }

Collection

1 technique

T1056.001KeyloggingEvidence1

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

Command and Control

3 techniques

T1090.003Multi-hop ProxyEvidence1

rule wsh_rat_reverse_proxy { ... description = " Alerts on the WSH RAT .NET reverse proxy module " ... $ str_2 = " WSH Reverse Proxy " ... }

T1102.002Bidirectional CommunicationEvidence1

“Telegram bots can be used as a Command and Control (C2) to exfiltrate data via text messages or arbitrary file uploads.”

T1105Ingress Tool TransferEvidence2

$ str_9 = " case \" up-n-exec \" "

Other

1 technique

T1562Impair DefensesEvidence1

Then it tries to disable the built-in defenses and starts gathering system information before downloading the RAT payload on the compromised host.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

uri●●●●●●●●●●●●View more in app5 months ago

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cofense blogNews

Mar 11, 2026

Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials

RAT family where observed campaigns use Telegram Bot API for notification/telemetry (e.g., victim download alerts and host profiling such as IP/geolocation/user-agent), sometimes from the initial download page rather than the RAT itself.

bleeping computerNews

Feb 15, 2022

Unskilled hacker linked to years of attacks on aviation, transport sectors

A commodity remote access trojan leveraged by TA2541 in phishing operations against sensitive industries.

proofpointNews

Feb 9, 2022

TA2541: Threats to Aviation, Aerospace, & Travel | Proofpoint US

Commodity remote access trojan observed in TA2541 campaigns, used for remote control and information gathering on compromised hosts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

WSH RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TA2541

According to the researcher’s observations, AsyncRAT, NetWire, WSH RAT, and Parallax appears to be the group’s top favorites being pushed most often in malicious messages.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence3

WSH RAT (A variant of H-Worm/Houdini) https://cofense.com/houdini-worm-transformed-new-phishing-attack

T1566.001Spearphishing AttachmentEvidence1

Proofpoint notes that TA2541 has been consistent about its attack method, relying on malicious Microsoft Word documents to deliver a remote access tool (RAT).

T1566.002Spearphishing LinkEvidence1

Recently, though, the group switched from malicious attachments to linking to a payload hosted in cloud services such as Google Drive.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

In the next step, the adversary executes PowerShell into various Windows processes and looks for available security products by querying the Windows Management Instrumentation (WMI).

T1059.001PowerShellEvidence1

If executed, PowerShell pulls an executable from a text file hosted on various platforms such as Pastetext, Sharetext, and GitHub.

T1059.005Visual BasicEvidence2

Proofpoint observed this group using Google Drive URLs in emails that lead to an obfuscated Visual Basic Script (VBS) file.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

T1555Credentials from Password StoresEvidence1

$ str_3 = " WSH Sdk for password recovery " ... $ str_4 = " wshlogs \\ recovered_password_email.log " ... $ str_10 = " Unable to automatically recover password "

Discovery

1 technique

T1082System Information DiscoveryEvidence2

Then it tries to disable the built-in defenses and starts gathering system information before downloading the RAT payload on the compromised host.

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

rule wsh_rat_rdp { ... description = " Alerts on the WSH RAT .NET RDP module " ... $ str_0 = " GET /open-rdp| " ... $ str_3 = " TakeShoot " ... }

Collection

1 technique

T1056.001KeyloggingEvidence1

rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }

Command and Control

3 techniques

T1090.003Multi-hop ProxyEvidence1

rule wsh_rat_reverse_proxy { ... description = " Alerts on the WSH RAT .NET reverse proxy module " ... $ str_2 = " WSH Reverse Proxy " ... }

T1102.002Bidirectional CommunicationEvidence1

“Telegram bots can be used as a Command and Control (C2) to exfiltrate data via text messages or arbitrary file uploads.”

T1105Ingress Tool TransferEvidence2

$ str_9 = " case \" up-n-exec \" "

Other

1 technique

T1562Impair DefensesEvidence1

Then it tries to disable the built-in defenses and starts gathering system information before downloading the RAT payload on the compromised host.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

uri●●●●●●●●●●●●View more in app5 months ago

domain●●●●●●●●●●●●View more in app9 months ago

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cofense blogNews

Mar 11, 2026

Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials

bleeping computerNews

Feb 15, 2022

Unskilled hacker linked to years of attacks on aviation, transport sectors

A commodity remote access trojan leveraged by TA2541 in phishing operations against sensitive industries.

proofpointNews

Feb 9, 2022

TA2541: Threats to Aviation, Aerospace, & Travel | Proofpoint US

Commodity remote access trojan observed in TA2541 campaigns, used for remote control and information gathering on compromised hosts.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.