Stealthy new JavaScript malware infects Windows PCs with RATs

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/stealthy-new-javascript-malware-infects-windows-pcs-with-rats/

A new stealthy JavaScript loader named RATDispenser is being used to infect devices with a variety of remote access trojans (RATs) in phishing attacks.

The novel loader was quick to establish distribution partnerships with at least eight malware families, all designed to steal information and give actors control over the target devices.

In 94% of the cases analyzed by the HP Threat Research team, RATDispenser does not communicate with an actor-controlled server and is solely used as a first-stage malware dropper.

Going against the trend of using Microsoft Office documents to drop payloads, this loader uses JavaScript attachments, which HP found to have low detection rates.

The infection begins with a phishing email containing a malicious JavaScript attachment named with a '.TXT.js' double-extension. As Windows hides extensions by default, if a recipient saves the file to their computer, it will appear as a harmless text file.

This text file is heavily obfuscated to bypass detection by security software and will be decoded when the file is double-clicked and launched.

Once launched, the loader will write a VBScript file to the %TEMP% folder, which is then executed to download the malware (RAT) payload.

Stealthy new JavaScript malware infects Windows PCs with RATs

A new stealthy JavaScript malware loader named RATDispenser is being used to infect devices with a variety of remote access trojans (RATs) in phishing attacks.

www.bleepingcomputer.com

Hiding Windows File Extensions is a Security Risk, Enable Now

Microsoft hides file extensions in Windows by default even though it's a security risk that is commonly abused by phishing emails and malware distributors to trick people into opening malicious files.

www.bleepingcomputer.com

 

[struppigel]

It's actually JScript, not JavaScript
Original article by HP:

RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild | HP Wolf Security

With a 11% detection rate, RATDispenser appears to be effective at evading security controls and delivering malware.

threatresearch.ext.hp.com

 

[Andy Ful]

People often confuse JScript with JavaScript because both have (almost) the same functions and syntax. The difference is that JScript is often executed by Windows Script Host and JavaScript is usually run by the web browser (can be also run via some LOLBins). So the script runs in different environments. If the attacker wants to infect a system then the JScript attachment is more convenient because the code is executed outside the web browser (no sandbox restrictions).

A similar misunderstanding is often with VBA macros and JavaScript. VBScript. One can use a JScript (JavaScript) VBScript code as a macro code, and this will work. But in this case, the code will be run by the MS Office interpreter.
One can also use VBScript as a macro code to run the JScript file (.js). The macro will be run via MS Office interpreter and the .js script will be run via Windows Script Host. Also, mshta.exe can be invoked from the macro to run VBscript or JavaScript code embedded in the .hta file, etc.

Edit.
I corrected my stupid misspelling (I wrote JScript instead of VBScript)
VBA is a real extension of VBScript, so the VBA code will not always run on a VBScript interpreter.

 

[Gandalf_The_Grey]

People often confuse JScript with JavaScript because both have the same functions and syntax. The difference is that JScript is often executed by Windows Script Host and JavaScript is usually run by the web browser (can be also run via some LOLBins). So the script runs in different environments. If the attacker wants to infect a system then the JScript attachment is more convenient because the code is executed outside the web browser (no sandbox restrictions).

A similar misunderstanding is often with VBA macros and JavaScript. One can use a JScript (JavaScript) code as a macro code, and this will work. But in this case, the code will be run by the MS Office interpreter.

Even HP and Bleeping Computer make that mistake, see the titles of those stories.

 

[LASER_oneXM]

This stealthy malware delivers a 'silent threat' that wants to steal your passwords

Cybersecurity researchers at HP Wolf Security warn about RATDispenser, a downloader that delivers trojan malware, information stealers and keyloggers.

www.zdnet.com

 

[wat0114]

People often confuse JScript with JavaScript because both have (almost) the same functions and syntax.

Exactly what I did here:

Windows XP turns 20: Microsoft’s rise and fall points to one thing — don’t fix what isn’t broken

If a browser process can get high IL, it can do what it wants. It is not still 'inside the sandbox', there is no inside the sandbox. There is...

www.wilderssecurity.com

Thanks for clarifying.