RecJS: a Multi-Component Malware hides behind JavaScript.

The Dell Sonicwall Threats Research team observed reports of a New Multi-Component family named GAV: RECJS.AB actively spreading in the wild. This time attackers used a Java Script .Js file dropped by an executable file. The malware uses Windows-based Script Host to run scripts on infected machine and hides behind a JavaScript file to avoid detection. One major component is responsible to take a Screenshot from infected machine and upload it to its own C&C server.

Infection Cycle:

The Malware uses the following icon:

Md5:

• 2a63b3a621d8e555734582d83b5e06a5 – Multi-Component Package

Droppers:

• aecef77725f3ee0b84b6b8046efe5ac0 – 7z.dll

• a1efcedc97c76b356f7ffa7cf909d733 – 7z.exe

• f3c7fb3cabab9af2291d55da05ce10fe – ns3B2.tmp

• e0c13aa81e0d5a2df8ecc98c969a6958 – nsExec.dll

• ae182dc797cd9ad2c025066692fc041b – System.dll

• 75fb0aecd2cfef2210495a4f3cab5bcf – windrv.exe

• f1a7ea45ced96bec4ad093f5dbd53b29 – e4a65dca09558335391ff7233ec51084.js
  

The Malware adds the following files to the system:

• Malware.exe

• %Temp% nsb3AE.tmpSystem.dll

• %Temp% nsb3AE.tmp nsExec.dll

• %Temp% nsb3AE.tmp ns3B2.tmp

• cmd.exe

  • %Userprofile%Application DataAppCache_3a879c0b9817492db842ebd53ca6a115

  • 7z.dll

  • 7z.exe

  • e4a65dca09558335391ff7233ec51084.js

  • svchost.exe

    • its a copy of Microsoft (R) Windows Based Script Host C:WINDOWSsystem32wscript.exe

  • taskhost.exe

    • its copy of Windows Command Processor C:WINDOWSsystem32cmd.exe

  • windrv.exe

    • It a app for capturing Screenshots from target system

The Malware adds the following files to the Windows startup folder to ensure persistence upon reboot:

• %Userprofile%Application Dataappdata.lnk

• %Userprofile%Start MenuProgramsStartupWindows Application Manager.lnk

  • C:WINDOWSsystem32wscript.exe /b /nologo /E:javascript “%Userprofile%Application data AppCache_3a879c0b9817492db842ebd53ca6a115 e4a65dca09558335391ff7233ec51084.js” startup

Once the computer is compromised, the malware copies of Windows Based Script Host wscript.exe and Windows Command Processor Cmd.exe to AppCache folder.

The Malware uses .JS script to grabbing information from the infected machine and uses legitimate windows apps to avoid the detection by AV Vendors.

In the background the Malware runs the following commands on the system:

• Cmd.exe

  • Cmd /c cd C:Documents and SettingsAdministratorApplication DataAppCache_3a879c0b9817492db842ebd53ca6a115 & copy /b 34c227 + 34c227bb + 34c22 + 34c227b + bb4736 + bb473 7z.exe

• %Temp% nsb3AE.tmp ns3B0.tmp

  • “%Userprofile%LOCALS~1Temp nsb3AE.tmp ns3B0.tmp” cmd /c cd %Userprofile%Application DataAppCache_3a879c0b9817492db842ebd53ca6a115 & copy /b 343b + 9398cde4 + 93 + 9398cd + 9398cde + 4c7d + 4c7d9ee9 7z.dll

The file e4a65dca09558335391ff7233ec51084.js is dropped after malware launches on the target system, the malware uses wscript.exe for grabbing information from the infected machine such as the version of installed Anti-Virus, here is an example:

The malware tries to retrieves the version of your Processor to create a unique ID from your system, here is an example:

When the Malware creates and unique ID from your system then its transfers information to its own C&C server with following format:

After a while malware starts to take screenshot from infected machine and save it into screenshot.png file and then upload it to its own C&C server.

Command and Control (C&C) Traffic

RECJS.AB performs C&C communication over 443 port. The malware sends your system information to its own C&C server via following format, here are some examples:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: RECJS.A
  B (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.