Rewterz Threat Alert – Ongoing njRAT Campaign Against Middle East

Severity

Medium

Analysis Summary

Lab52 researchers analyzed infrastructure and associated malware samples indicating a long, ongoing njRAT campaign against the Middle East. The researchers’ analysis began with the domain they found being used for C2 in both a Vjw0rm and a njRAT sample. By pivoting off of the IP addresses tied to this domain, a series of suspicious, dynamic domains were discovered as being associated to one of the IPs. Using this IP address, further link analysis revealed a large number of malware samples, most of which were modified njRAT executables. Strings within the samples aligned with open source reporting related to njRAT. Once installed on a system, the njRAT can provide attackers with both keylogging functions and RAT capabilities, such as being able to download and execute additional binaries. Based on their findings, the researchers hypothesize that this campaign has been active for an extended period of time and the attackers have been constantly evolving their activities.

Impact

• Keylogging
• Exposure of sensitive information

Indicator of Compromise

SHA256

• 2f79d0e4225a89c91687f126e0a83d0d4e6089fceb4507fff35da92fe8f69eb9

• f874d130689ddb025f13a52ebd70b06a949c7968d4ce16d9480a0328e2819b70

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.