Rewterz Threat Advisory – CVE-2020-5616 – Multiple PHP Factory products security bypass
August 5, 2020Rewterz Threat Advisory – CVE-2020-5384 – RSA MFA Agent for Microsoft Windows security bypass
August 5, 2020Severity
High
Analysis Summary
A new infection chain and obfuscation techniques used by njRAT in recent campaigns. The first method discussed is packaging the payload inside installers for legitimate software. Although the legitimate software is installed on the system, to avoid raising the suspicions of the victim, an infection chain is also kicked off. First a VBS file is dropped that maintains persistence via the Startup folder. This script is responsible for the execution of a series of PowerShell scripts that ultimately download and run the njRAT payload from a legitimate cloud hosting service, such as OneDrive. In another case, PowerShell scripts, masquerading as image files, are downloaded with the final payload being loaded via process injection. These newer samples of njRAT include additional obfuscation, such as the use of ConfuserEx, and anti-analysis techniques, such as detecting VM and debugging software. Once installed on the system, njRAT provides the attacker with the ability to obtain system information and process commands received from its C2 server.
Impact
- Information disclosure
- Exposure of sensitive data
Indicators of Compromise
MD5
- df291350b793205204e2e305af9eb1fb
- 4563f44a47220396760ffec3aabceead
- 2094f262e378273f08f836699953605f
- d7668d89577fec1912418da082c4c5c3
- 13180caea7565ed8cde3e2b3a6c59313
- f9747a5cdd3f329572e5945a80fe11e7
- e1eda3e6f6b204d486b6a97026c9feae
- 041e3fe888230e1dda9949a8a741054e
- 57445041f7a1e57da92e858fc3efeabe
URL
- hxxps[:]//2u[.]pw/3aX42
- https[:]//2u[.]pw/zIH2Z
- hxxps[:]//2u[.]pw/RxSsS
- hxxps[:]//dl[.]dropboxusercontent[.]com/s/m6q5dhmjpfxes94/ps2[.]txt
- hxxps[:]//dl[.]dropboxusercontent[.]com/s/lpoe7mktxd3zi1r/ps1[.]txt
- hxxps[:]//onedrive[.]live[.]com/download?cid=673EE675C72FC07C&resid=673EE675C72FC07C%21132&authkey=AIMSMV6FkJfJyCI
- hxxps[:]//onedrive[.]live[.]com/download?cid=F8F1505E1B355606&resid=F8F1505E1B355606!1388&authkey=AM1NXoCYykwqLFA
- hxxps[:]//onedrive[.]live[.]com/Download?cid=1999A3757EF7BB87&resid=1999A3757EF7BB87%21126&authkey=ANPgrMDyhVNehZI
- hxxp[:]//www[.]asmreekasounds[.]com/upfiles/up_down/1fe352263637133298954dbac2a7821a[.]mp3
Remediation
Block all threat indicators at your respective controls.