Monday, October 7, 2024
HomeCyber AttackBeware of Weaponized TeamViewer Installer that Delivers njRAT

Beware of Weaponized TeamViewer Installer that Delivers njRAT

Published on

Threat actors relying on legitimate, well-known software TeamViewer for exploitation has been a very common scenario.

There have been several cases where threat actors used well-known software to deliver malware to the victims.

Similarly, a recent report from Cyble Research & Intelligence Labs stated that the most popularly used remote desktop support software, “TeamViewer” has been exploited by threat actors to deliver njRAT malware.

- Advertisement - EHA

Other software that was delivering njRAT malware include Wireshark, Process Hacker, etc.,

njRAT is a remote access trojan that can perform keylogging, password stealing, data exfiltration, accessing webcams, and microphones, downloading additional files, and many others.

It was first discovered in 2012 and was attacking organizations in Middle Eastern nations. 

Weaponized TeamViewer Installer

The Initial level of compromise for njRAT involves traditional methods like phishing campaigns, cracked software on file-sharing websites, and drive-by downloads. In addition to this, the malware is now being distributed via trojanized applications.

njRAT malware dropped on the Windows Folder (Source: Cyble)

Once the malware is executed, it drops two files on the C:\Windows folder in which, one of them is the njRAT malware.

The Installer then triggers the malware “TeamViewer Starting.exe” and eventually launches the legitimate “teamviewer.exe” application.

During the installation of TeamViewer, njRAT simultaneously starts the installation by copying itself to the \AppData\Local\Temp folder with the name “system.exe.”

It then executes the newly dropped file, and njRAT creates a mutex.

Post Exploitation and Persistence

njRAT modifies the “SEE_MASK_NOZONECHECKS” environment variable in Windows, which prevents security warning prompts or dialog boxes from being presented to the user, thereby operating without any hindrance.  

njRAT autorun entries in System Registry (Source: Cyble)

Furthermore, the malware also changes the Firewall regulation to allow communications with the C2 (Command and Control) server. 

The malware creates two autorun entries in the system registry to maintain persistence in the system. 

The malware then collects information about Keystrokes, Windows OS version, service pack, webcam information, the current date, username, system architecture, and specific registry keys.

It stores all of this information in the “%appdata%/temp” folder under the filename “System.exe.tmp”.

Indicators of Compromise

Indicators Description 
224ae485b6e4c1f925fff5d9de1684415670f133f3f8faa5f23914c78148fc31Trojanized Teamviewer
9b9539fec7d0227672717e126a9b46cda3315895
11aacb03c7e370d2b78b99efe9a131eb
9bcb093f911234d702a80a238cea14121c17f0b27d51bb023768e84c27f1262asystem.exe/ TeamViewer Starting.exe
b2f847dce91be5f5ea884d068f5d5a6d9140665c
8ccbb51dbee1d8866924610adb262990
hxxp://kkk[.]no-ip[.]biz                      C&C
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Chinese Group Hacked US Court Wiretap Systems

Chinese hackers have infiltrated the networks of major U.S. broadband providers, gaining access to...

19.6K+ Public Zimbra Installations Vulnerable to Code Execution Attacks – CVE-2024-45519

A critical vulnerability in Zimbra's postjournal service, identified as CVE-2024-45519, has left over 19,600...

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam

A new ransomware campaign targeting individuals and organizations in the UK and the US...

Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group

Microsoft and the U.S. Department of Justice (DOJ) have successfully dismantled a network of...

Free Webinar

Decoding Compliance | What CISOs Need to Know

Non-compliance can result in substantial financial penalties, with average fines reaching up to $4.5 million for GDPR breaches alone.

Join us for an insightful panel discussion with Chandan Pani, CISO - LTIMindtree and Ashish Tandon, Founder & CEO – Indusface, as we explore the multifaceted role of compliance in securing modern enterprises.

Discussion points

The Role of Compliance
The Alphabet Soup of Compliance
Compliance
SaaS and Compliance
Indusface's Approach to Compliance

More like this

Chinese Group Hacked US Court Wiretap Systems

Chinese hackers have infiltrated the networks of major U.S. broadband providers, gaining access to...

19.6K+ Public Zimbra Installations Vulnerable to Code Execution Attacks – CVE-2024-45519

A critical vulnerability in Zimbra's postjournal service, identified as CVE-2024-45519, has left over 19,600...

Prince Ransomware Hits UK and US via Royal Mail Phishing Scam

A new ransomware campaign targeting individuals and organizations in the UK and the US...