• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-5616 – Multiple PHP Factory products security bypass
August 5, 2020
Rewterz Threat Advisory – CVE-2020-5384 – RSA MFA Agent for Microsoft Windows security bypass
August 5, 2020

Rewterz Threat Alert – New njRAT Injection Chain

August 5, 2020

Severity

High

Analysis Summary

A new infection chain and obfuscation techniques used by njRAT in recent campaigns. The first method discussed is packaging the payload inside installers for legitimate software. Although the legitimate software is installed on the system, to avoid raising the suspicions of the victim, an infection chain is also kicked off. First a VBS file is dropped that maintains persistence via the Startup folder. This script is responsible for the execution of a series of PowerShell scripts that ultimately download and run the njRAT payload from a legitimate cloud hosting service, such as OneDrive. In another case, PowerShell scripts, masquerading as image files, are downloaded with the final payload being loaded via process injection. These newer samples of njRAT include additional obfuscation, such as the use of ConfuserEx, and anti-analysis techniques, such as detecting VM and debugging software. Once installed on the system, njRAT provides the attacker with the ability to obtain system information and process commands received from its C2 server.

Impact

  • Information disclosure
  • Exposure of sensitive data

Indicators of Compromise

MD5

  • df291350b793205204e2e305af9eb1fb
  • 4563f44a47220396760ffec3aabceead
  • 2094f262e378273f08f836699953605f
  • d7668d89577fec1912418da082c4c5c3
  • 13180caea7565ed8cde3e2b3a6c59313
  • f9747a5cdd3f329572e5945a80fe11e7
  • e1eda3e6f6b204d486b6a97026c9feae
  • 041e3fe888230e1dda9949a8a741054e
  • 57445041f7a1e57da92e858fc3efeabe

URL

  • hxxps[:]//2u[.]pw/3aX42
  • https[:]//2u[.]pw/zIH2Z
  • hxxps[:]//2u[.]pw/RxSsS
  • hxxps[:]//dl[.]dropboxusercontent[.]com/s/m6q5dhmjpfxes94/ps2[.]txt
  • hxxps[:]//dl[.]dropboxusercontent[.]com/s/lpoe7mktxd3zi1r/ps1[.]txt
  • hxxps[:]//onedrive[.]live[.]com/download?cid=673EE675C72FC07C&resid=673EE675C72FC07C%21132&authkey=AIMSMV6FkJfJyCI
  • hxxps[:]//onedrive[.]live[.]com/download?cid=F8F1505E1B355606&resid=F8F1505E1B355606!1388&authkey=AM1NXoCYykwqLFA
  • hxxps[:]//onedrive[.]live[.]com/Download?cid=1999A3757EF7BB87&resid=1999A3757EF7BB87%21126&authkey=ANPgrMDyhVNehZI
  • hxxp[:]//www[.]asmreekasounds[.]com/upfiles/up_down/1fe352263637133298954dbac2a7821a[.]mp3

Remediation

Block all threat indicators at your respective controls.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.