Loading malware…
H-Worm, also known as Houdini RAT or Houdini, is a Visual Basic Script-based remote access trojan active since at least 2013. It is a commodity Windows malware family used to provide attackers with persistent remote control over infected systems. Documented functionality includes theft of system information, screenshot capture, keystroke logging, webcam access, file deletion, and self-removal, making it suitable for surveillance and post-compromise data collection.
H-Worm has been delivered in phishing campaigns using script-based payloads and archive attachments, including JavaScript droppers that install VBS stages and establish persistence through startup mechanisms or autorun configuration. It has also appeared in multi-stage infection chains in which malicious documents or downloaded payloads ultimately unpack to H-Worm. The malware has been observed in campaigns using aviation-themed lures and in operations targeting Ukrainian organizations, demonstrating continued use by multiple threat actors rather than exclusive association with a single operator.
The malware is closely associated with the handle "Houdini," and public reporting has linked its development and dissemination to Mohammed Benabdellah. H-Worm has also been referenced alongside njRAT in some reporting, though the relationship between the two names is inconsistently described across sources. Beyond its original developer association, H-Worm has been used by unrelated actors, including criminal phishing operators and intrusion sets employing commodity malware for espionage, credential theft, fraud enablement, and broader post-exploitation activity.
H-Worm primarily targets Windows environments and is notable for its script-based implementation, which allows easy obfuscation and repackaging by downstream operators. Its continued appearance in phishing-led campaigns reflects its low barrier to use, adaptability, and utility as a lightweight RAT for persistence, surveillance, and exfiltration-oriented intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
After deobfuscating the VBS script we could identify the malware sample as Houdini’s H-Worm... This script will be the one which implements the RAT identified as H-worm after a complex nested obfuscation, prepended with a confusing extra line.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Details: wscript.exe //B “C:\Users\Lucas\AppData\Roaming\tk.vbs” ... This direct access points at the following Powershell execution
We found the initial macros for testing and then another version that, for the untrained eye, would seem like a perfectly normal macro. In both cases, the macro extracts data from the Microsoft Form object embedded in the malicious document.
Opening the malicious attachment executes an HTML file with embedded JavaScript that is highly likely generated by an LLM. This script is designed to download and execute additional payloads
The other two files found along with this PDF at its arrival via phishing email have the exact same content (even same hash) in spite of having a different name: LIST OF AVAILABLE JOBS.js SALARY AND HIRING CONDITIONS.js This highly obfuscated JavaScript has the only purpose of dropping a second VBS script
For those samples where the VBS script was not dropped in the startup folder, the following persistence mechanism would be established using the registry keys: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tk ... HKU\*\Software\Microsoft\Windows\CurrentVersion\Run\tk
For those samples where the VBS script was not dropped in the startup folder, the following persistence mechanism would be established using the registry keys: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tk ... HKU\*\Software\Microsoft\Windows\CurrentVersion\Run\tk
rule wsh_rat_keylogger { ... description = " Alerts on the WSH RAT .NET keylogger module " ... $ str_1 = " RunKeyloggerOffline " ... $ str_3 = " sendKeyLog " ... }
In the initial behavior analysis of these next stage VBS samples, we observed C2 contact through HTTP POST requests to the port 449 of the IP address 45.91.92.112 resolved from stub.]ignorelist.]com.
rule wsh_rat_reverse_proxy { ... description = " Alerts on the WSH RAT .NET reverse proxy module " ... $ str_2 = " WSH Reverse Proxy " ... }
119 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Visual Basic Script-based remote access trojan that can steal system information, capture screenshots, log keystrokes, view the webcam, delete files, and uninstall itself.
Remote access trojan (RAT) family referenced in connection with the UAE-based hack-for-hire group via links to its original developers; the content does not describe specific technical capabilities beyond identifying it as H-Worm/njRAT.
A VBS-based remote access trojan used in the LazyScripter campaign. The JavaScript drops a VBS loader/payload that establishes persistence, contacts C2 infrastructure, profiles the infected host, and executes the deobfuscated H-Worm RAT code.
Malware family found in a related 2019 sample communicating with groups[.]us[.]to; discussed as part of linked but lower-confidence infrastructure and historical associations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.