A new JavaScript loader named RATDispenser is being used to infect devices with a variety of remote access trojans (RATs) in phishing attacks.
See also: Malware tries to exploit new Windows Installer zero-day
The new loader quickly formed distribution partnerships with at least eight malware families, all designed to steal information and give hackers control of targeted devices.
In 94% of cases analyzed by the HP Threat Research team, RATDispenser does not communicate with a hacker-controlled server and is used exclusively as a first-stage malware dropper.
Unlike the trend of using Microsoft Office documents to drop payloads, this loader uses JavaScript attachments, which HP has found to have low detection rates.
The infection begins with a phishing email containing a malicious JavaScript attachment named with a double extension “.TXT.js.” As Windows hides extensions by default, if a recipient saves the file to their computer, it will appear as a harmless text file.
See also: Hackers deploy Linux malware on e-commerce servers
This text file is heavily obfuscated to bypass detection by security software and will be decoded when the file is double-clicked and launched.
Once launched, the loader will write a VBScript file to the %TEMP% folder, which is then executed to download the malware (RAT) payload.
These levels of obfuscation help the malware evade detection in 89% of cases, based on VirusTotal scan results.
However, email gateways will detect the loader if the organization has enabled blocking of executable attachments, such as .js, .exe, .bat, .com files.
Another way to stop the infection chain from unfolding is to change the default file handler for JS files, allow only digitally signed scripts to run, or disable WSH (Windows Script Host).
HP researchers have managed to recover eight different malware payloads from RATDispenser over the past three months.
See also: Alibaba ECS: Actively compromised by cryptomining malware
The malware families detected are STRRAT, WSHRAT, AdWind, Formbook, Remcos, Panda Stealer, GuLoader and Ratty.
In 10 of the 155 samples analyzed, the loader established C2 communication to retrieve second-stage malware, so while this is rare, the functionality exists.
In 81% of malware drop cases, RATDispenser distributes STRRAT and WSHRAT (also known as “Houdini”), two powerful credential stealers and keyloggers.
Panda Stealer and Formbook are the only two payloads that are always accepted instead of being dropped.
Overall, RATDispenser appears to cater to the distribution of both old and new malware, serving as a versatile loader for threat actors of all skill levels.
Information source: bleepingcomputer.com
