Loading malware…
H-Worm, also known as Houdini RAT, is a Visual Basic Script-based remote access Trojan targeting Windows systems. First observed in 2013, it was developed by an actor using the handle Houdini. Its capabilities include system-information theft, screenshot capture, keystroke logging, webcam access, file deletion, and self-uninstallation, enabling remote surveillance and control of infected systems.
H-Worm has been distributed through phishing and spearphishing campaigns using malicious attachments, compressed archives, and document-themed lures. Observed infection chains include obfuscated JavaScript droppers that install the VBS payload and malicious documents that retrieve it. Deployments have established persistence through Windows startup locations and automatic-execution registry entries, while nested script obfuscation conceals the payload. H-Worm communicates with attacker-controlled infrastructure using HTTP requests.
The malware has been used by OPERA1ER in campaigns targeting African banks and financial-services organizations and by LazyScripter in a 2021 phishing campaign targeting European entities with recruitment lures impersonating international organizations. It has also been observed targeting Ukrainian environments. H-Worm is commodity malware used by multiple operators rather than a tool exclusive to a single threat actor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“It seems that NanoCore and H-Worm were mostly used until 2019 and were replaced gradually in 2020 by other observed families.”
After deobfuscating the VBS script we could identify the malware sample as Houdini’s H-Worm... This script will be the one which implements the RAT identified as H-worm after a complex nested obfuscation, prepended with a confusing extra line.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Details: wscript.exe //B “C:\Users\Lucas\AppData\Roaming\tk.vbs” ... This direct access points at the following Powershell execution
We found the initial macros for testing and then another version that, for the untrained eye, would seem like a perfectly normal macro. In both cases, the macro extracts data from the Microsoft Form object embedded in the malicious document.
Opening the malicious attachment executes an HTML file with embedded JavaScript that is highly likely generated by an LLM. This script is designed to download and execute additional payloads
The other two files found along with this PDF at its arrival via phishing email have the exact same content (even same hash) in spite of having a different name: LIST OF AVAILABLE JOBS.js SALARY AND HIRING CONDITIONS.js This highly obfuscated JavaScript has the only purpose of dropping a second VBS script
For those samples where the VBS script was not dropped in the startup folder, the following persistence mechanism would be established using the registry keys: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tk ... HKU\*\Software\Microsoft\Windows\CurrentVersion\Run\tk
For those samples where the VBS script was not dropped in the startup folder, the following persistence mechanism would be established using the registry keys: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tk ... HKU\*\Software\Microsoft\Windows\CurrentVersion\Run\tk
rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }
In the initial behavior analysis of these next stage VBS samples, we observed C2 contact through HTTP POST requests to the port 449 of the IP address 45.91.92.112 resolved from stub.]ignorelist.]com.
rule wsh_rat_reverse_proxy { ... description = " Alerts on the WSH RAT .NET reverse proxy module " ... $ str_2 = " WSH Reverse Proxy " ... }
119 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Visual Basic Script-based remote access trojan that can steal system information, capture screenshots, log keystrokes, view the webcam, delete files, and uninstall itself.
Remote access trojan (RAT) family referenced in connection with the UAE-based hack-for-hire group via links to its original developers; the content does not describe specific technical capabilities beyond identifying it as H-Worm/njRAT.
A VBS-based remote access trojan used in the LazyScripter campaign. The JavaScript drops a VBS loader/payload that establishes persistence, contacts C2 infrastructure, profiles the infected host, and executes the deobfuscated H-Worm RAT code.
Malware family found in a related 2019 sample communicating with groups[.]us[.]to; discussed as part of linked but lower-confidence infrastructure and historical associations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.