Rewterz Threat Alert – Divergent: Fileless Malware Using NodeJS

September 27, 2019

Severity

Medium

Analysis Summary

A new malware loader being used to deliver and infect systems with a previously undocumented malware payload called Divergent. This threat uses NodeJS — a program that executes JavaScript outside of a web browser — as well as the legitimate open-source utility WinDivert to facilitate some of the functionality in the Divergent malware. The use of NodeJS is not something commonly seen across malware families.

The observed malware campaigns associated with Divergent feature the use of persistence techniques most commonly associated with “fileless” malware. This malware can be leveraged by an attacker to target corporate networks and appears to be primarily designed to conduct click-fraud. It also features several characteristics that have been observed in other click-fraud malware, such as Kovter.

Impact

Exposure of sensitive information

Indicators of Compromise

URLs

hxxps[:]//1292172017[.]rsc[.]cdn77[.]org/images/trpl[.]png
hxxps[:]//1292172017[.]rsc[.]cdn77[.]org/imtrack/strkp[.]png

Malware Hash (MD5/SHA1/SH256)

ba04eacaa80bb5da6b02e1e7fdf3775cf5a44a6179b2c142605e089d78a2f5b6
a82dd93585094aeba4363c5aeedd1a85ef72c60a03738b25d452a5d895313875
2f4a9ef2071ee896674e3da1a870d4efab4bb16e2e26ea3d7543d98b614ceab9
77498f0ef4087175aa85ce1388f9d02d14aaf280e52ce7c70f50d3b8405fea9f
b2d29bb9350a0df93d0918c0208af081f917129ee46544508f2e1cf30aa4f4ce
bf2cdd1dc2e20c42d2451c83b8280490879b3515aa6c15ab297419990e017142
ba04eacaa80bb5da6b02e1e7fdf3775cf5a44a6179b2c142605e089d78a2f5b6
a7656ccba0946d25a4efd96f4f4576494d5f1e23e6ad2acc16d2e684656a2d4f
607b2f3fd1e73788a4d6f5a366c708dbb12d174eba9863ade0af89ca40e1fdba

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the link/attachments sent by unknown senders.