Rewterz Threat Alert – Cloud based python RAT targeting Middle Eastern countries

Severity

High

Analysis Summary

A new RAT called “JhoneRAT” is found infecting Middle Eastern targets via malicious Microsoft Office documents. The dropper, along with the Python RAT, attempts to gather information on the victim’s machine and then uses multiple cloud services: Google Drive, Twitter, ImgBB and Google Forms. The RAT attempts to download additional payloads and upload the information gathered during the reconnaissance phase. The target filtering is performed by checking the keyboard layout of the infected systems. Based on the analysed sample, JhoneRAT targets Saudi Arabia, Iraq, Egypt, Libya, Algeria, Morocco, Tunisia, Oman, Yemen, Syria, UAE, Kuwait, Bahrain and Lebanon. Three malicious Microsoft Office documents are found that exploit the vulnerability CVE-2017-0199.

CVE-2017-0199

This vulnerability allows remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.” Affected products are Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1 and Windows 8.1

Impact

• Unauthorized Remote Access
• Data exfiltration

Indicators of Compromise

MD5

• 4ae4e0f8747a27f41e444fbc047f0191
• bdd38fdc1c057ccfa416abafa46f0e84
• 089531d78aad6a897c041e7270feea2b
• 7ef4accc31ccbce777cbde68ffa1caec
• 1807e27f6badbb199e95e6d3abdae1dc
• f2e741253b8085bc9e738cc5ae50e735
• 7c487d8462567a826da95c799591f5fb

SHA-256

• 273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f
• 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69
• d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079
• 4228a5719a75be2d6658758fc063bd07c1774b44c10b00b958434421616f1548
• b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366
• 6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4
• 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091

SHA1

• a1b70f143cb91d8ad16ab2ebb109517632e36ce6
• 6ac3fd0b6984cd05ca2a0062a7be2f4e49d5c19d
• c33930f7f38f7ece2cad3a4cb11308c07e47eeb1
• a00cbf454c6b8db90fe5e8480e7f03b73f4e6873
• 579c10219b962b96a5f84010f29eba2c387ef4c5
• 0ce95e5bdd8ff77f0d3e208f168a1aa943c4a920
• 7551f49c26c17ad60e97112cbad4a97ab130545f

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Do not download random files from untrusted sources on the internet.
• Update the affected products to a patched version.