Rewterz Threat Alert – New njRAT Injection Chain

Severity

High

Analysis Summary

A new infection chain and obfuscation techniques used by njRAT in recent campaigns. The first method discussed is packaging the payload inside installers for legitimate software. Although the legitimate software is installed on the system, to avoid raising the suspicions of the victim, an infection chain is also kicked off. First a VBS file is dropped that maintains persistence via the Startup folder. This script is responsible for the execution of a series of PowerShell scripts that ultimately download and run the njRAT payload from a legitimate cloud hosting service, such as OneDrive. In another case, PowerShell scripts, masquerading as image files, are downloaded with the final payload being loaded via process injection. These newer samples of njRAT include additional obfuscation, such as the use of ConfuserEx, and anti-analysis techniques, such as detecting VM and debugging software. Once installed on the system, njRAT provides the attacker with the ability to obtain system information and process commands received from its C2 server.

Impact

• Information disclosure
• Exposure of sensitive data

Indicators of Compromise

MD5

• df291350b793205204e2e305af9eb1fb
• 4563f44a47220396760ffec3aabceead
• 2094f262e378273f08f836699953605f
• d7668d89577fec1912418da082c4c5c3
• 13180caea7565ed8cde3e2b3a6c59313
• f9747a5cdd3f329572e5945a80fe11e7
• e1eda3e6f6b204d486b6a97026c9feae
• 041e3fe888230e1dda9949a8a741054e
• 57445041f7a1e57da92e858fc3efeabe

URL

• hxxps[:]//2u[.]pw/3aX42
• https[:]//2u[.]pw/zIH2Z
• hxxps[:]//2u[.]pw/RxSsS
• hxxps[:]//dl[.]dropboxusercontent[.]com/s/m6q5dhmjpfxes94/ps2[.]txt
• hxxps[:]//dl[.]dropboxusercontent[.]com/s/lpoe7mktxd3zi1r/ps1[.]txt
• hxxps[:]//onedrive[.]live[.]com/download?cid=673EE675C72FC07C&resid=673EE675C72FC07C%21132&authkey=AIMSMV6FkJfJyCI
• hxxps[:]//onedrive[.]live[.]com/download?cid=F8F1505E1B355606&resid=F8F1505E1B355606!1388&authkey=AM1NXoCYykwqLFA
• hxxps[:]//onedrive[.]live[.]com/Download?cid=1999A3757EF7BB87&resid=1999A3757EF7BB87%21126&authkey=ANPgrMDyhVNehZI
• hxxp[:]//www[.]asmreekasounds[.]com/upfiles/up_down/1fe352263637133298954dbac2a7821a[.]mp3

Remediation

Block all threat indicators at your respective controls.