ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool H-Worm

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: H-Worm

NamesH-Worm
H-Worm RAT
Houdini RAT
Iniduoh
Jenxcus
Kognito
WSHRAT
dinihou
dunihi
CategoryMalware
TypeBackdoor, Info stealer
Description(FireEye) H-worm is a VBS (Visual Basic Script) based RAT written by an individual going by the name Houdini. We believe the author is based in Algeria and has connections to njq8, the author of njw0rm and njRAT/LV through means of a shared or common code base. We have seen the H-worm RAT being employed in targeted attacks against the international energy industry; however, we also see it being employed in a wider context as run of the mill attacks through spammed email attachments and malicious links.
Information<https://www.fireeye.com/blog/threat-research/2013/09/now-you-see-me-h-worm-by-houdini.html>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.houdini>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:h-worm>

Last change to this tool card: 23 April 2021

Download this tool card in JSON format

Previous: Hussar
Next: HyperBro

All groups using tool H-Worm

ChangedNameCountryObserved

APT groups

 Molerats, Extreme Jackal, Gaza Cybergang[Gaza]2012-Apr 2021 
     ↳ Subgroup: Pat Bear, APT-C-37Syria2015 
 WIRTE Group[Middle East]2018 

3 groups listed (3 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key