Trusted Design

Down the H-W0rm Hole with Houdinis RAT

概要

Commodity Remote Access Trojans (RATs) -- which are designed, productized and sold to the casual and experienced hacker alike -- put powerful remote access capabilities into the hands of criminals. RATs, such as H-W0rm, njRAT, KilerRAT, DarkComet, Netwire, XtremeRAT, JSocket/AlienSpy/Adwind and others, hold special interest for the Threat Research Team at Fidelis Cybersecurity. We're constantly following, detecting and monitoring the lifecycle of these RATs as they appear, disappear and often reappear under a new moniker. There have been recent reports 1, 2 about a new version of one such commodity RAT, H-W0rm (Hworm), and the various campaigns it is being used in. Our telemetry shows that H-W0rm is one of the most active RATs we've seen, with infections observed across virtually all enterprise verticals and geographies in which Fidelis Cybersecurity products are deployed.

Created: 2026-02-23

Indicators

• hostname - p-dark.zapto.org -
• hostname - amran-pc.no-ip.biz -
• hostname - extreme33.dns1.us -
• hostname - hell222.no-ip.biz -
• hostname - xxtataxx.no-ip.biz -
• hostname - king0780.no-ip.biz -
• hostname - onyeomachawa50.dynns.com -
• hostname - kohen.no-ip.org -
• hostname - vipvip3.dyndns.org -
• FileHash-MD5 - 361c9d44809f788b92023b762e363449 -
• hostname - microsoftntdll.sytes.net -
• hostname - org.publicvm.com -
• hostname - ines0049.ddns.net -
• hostname - aktam04.no-ip.info -
• hostname - khdt1.zapto.org -
• hostname - updlate.serveminecraft.net -
• hostname - wormaa.zapto.org -
• hostname - doda.redirectme.net -
• hostname - cyberspy.zapto.org -
• hostname - smoker21.hopto.org -
• hostname - anarqe77.no-ip.biz -
• hostname - xdz.no-ip.org -
• hostname - sara-tabuk.no-ip.biz -
• hostname - azo8oz.no-ip.biz -
• FileHash-MD5 - 6b3ef140a6062d7fa295c8fedde7d689 -
• hostname - microsoft8.publicvm.com -
• hostname - microsoftsystem.sytes.net -
• hostname - herohero.no-ip.org -
• hostname - g00gle.sytes.net -
• hostname - ksa2013.no-ip.biz -
• FileHash-MD5 - 06e125132b458321f97b6409a4db9ac4 -
• hostname - anonymous-0.no-ip.biz -
• hostname - hacker0021.no-ip.biz -
• hostname - qalsdahxjnm.no-ip.biz -
• hostname - maxy.no-ip.info -
• hostname - dz47.linkpc.net -
• hostname - bifrost-jordan.zapto.org -
• hostname - syses.sytes.net -
• hostname - strangler89.no-ip.org -
• hostname - njrat2012.no-ip.biz -
• hostname - 9amoo.zapto.org -
• hostname - ronaldo-123.no-ip.biz -
• hostname - asdfghj123.ddns.net -
• hostname - mi0.bounceme.net -
• hostname - 3bod-x.no-ip.biz -
• hostname - douda.linkpc.net -
• hostname - j2w2d.no-ip.biz -
• hostname - x.dvr-ddns.com -
• FileHash-MD5 - 0de41aef336f40a07ed6984db61b52ab -
• hostname - dmar123.no-ip.biz -
• hostname - yahia17.no-ip.org -
• hostname - adolf2013.sytes.net -
• hostname - jeflex.no-ip.org -
• hostname - jn.redirectme.net -
• hostname - fecabook.redirectme.net -
• hostname - ody.no-ip.biz -
• hostname - vipx.zapto.org -
• hostname - swanox.no-ip.org -
• hostname - douda.no-ip.info -
• hostname - righi.linkpc.net -
• hostname - hbooob.no-ip.biz -
• hostname - systim.publicvm.com -
• hostname - ali252612.zapto.org -
• hostname - ah99.no-ip.info -
• hostname - mouradel.no-ip.org -
• hostname - support.microsoft.linkpc.net -
• hostname - king999.ddns.net -
• hostname - kingofus.myq-see.com -
• hostname - ahmad212.no-ip.biz -
• hostname - akaros79.no-ip.biz -
• hostname - noooot.no-ip.biz -
• hostname - qwwq.no-ip.biz -
• hostname - epohme.no-ip.org -
• FileHash-MD5 - e081a42d6e09a3fcf049a33b2ecf0412 -
• hostname - googlechrome.servequake.com -
• hostname - justprogamers.ddns.net -
• hostname - aabod8.no-ip.biz -
• hostname - hussamhack.no-ip.biz -
• hostname - mohamedmmk.zapto.org -
• hostname - klonkino.no-ip.org -
• hostname - max-ps.sytes.net -
• hostname - pilo-raouf.no-ip.biz -
• hostname - mastlg.no-ip.biz -
• hostname - qwwq.servehttp.com -
• hostname - aaaazzzz9999000.no-ip.biz -
• hostname - elaspany.ddns.net -
• hostname - buildeasy.hopto.org -
• hostname - 1cowsound.mooo.com -
• hostname - 43r0m4x.publicvm.com -
• hostname - universal2010.no-ip.org -

類似Pulses

• RATs from the Underground (score: 0.77)
• Ding! Your RAT has been delivered (score: 0.66)
• RTF Exploit Installs Italian RAT: uWarrior (score: 0.65)
• RATs, Hackers and Rihanna (score: 0.64)
• Spam Campaign Distributes AdWind RAT (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る