Threat actors relying on legitimate, well-known software TeamViewer for exploitation has been a very common scenario.
There have been several cases where threat actors used well-known software to deliver malware to the victims.
Similarly, a recent report from Cyble Research & Intelligence Labs stated that the most popularly used remote desktop support software, “TeamViewer” has been exploited by threat actors to deliver njRAT malware.
Other software that was delivering njRAT malware include Wireshark, Process Hacker, etc.,
njRAT is a remote access trojan that can perform keylogging, password stealing, data exfiltration, accessing webcams, and microphones, downloading additional files, and many others.
It was first discovered in 2012 and was attacking organizations in Middle Eastern nations.
The Initial level of compromise for njRAT involves traditional methods like phishing campaigns, cracked software on file-sharing websites, and drive-by downloads. In addition to this, the malware is now being distributed via trojanized applications.
Once the malware is executed, it drops two files on the C:\Windows folder in which, one of them is the njRAT malware.
The Installer then triggers the malware “TeamViewer Starting.exe” and eventually launches the legitimate “teamviewer.exe” application.
During the installation of TeamViewer, njRAT simultaneously starts the installation by copying itself to the \AppData\Local\Temp folder with the name “system.exe.”
It then executes the newly dropped file, and njRAT creates a mutex.
njRAT modifies the “SEE_MASK_NOZONECHECKS” environment variable in Windows, which prevents security warning prompts or dialog boxes from being presented to the user, thereby operating without any hindrance.
Furthermore, the malware also changes the Firewall regulation to allow communications with the C2 (Command and Control) server.
The malware creates two autorun entries in the system registry to maintain persistence in the system.
The malware then collects information about Keystrokes, Windows OS version, service pack, webcam information, the current date, username, system architecture, and specific registry keys.
It stores all of this information in the “%appdata%/temp” folder under the filename “System.exe.tmp”.
Indicators | Description |
224ae485b6e4c1f925fff5d9de1684415670f133f3f8faa5f23914c78148fc31 | Trojanized Teamviewer |
9b9539fec7d0227672717e126a9b46cda3315895 | |
11aacb03c7e370d2b78b99efe9a131eb | |
9bcb093f911234d702a80a238cea14121c17f0b27d51bb023768e84c27f1262a | system.exe/ TeamViewer Starting.exe |
b2f847dce91be5f5ea884d068f5d5a6d9140665c | |
8ccbb51dbee1d8866924610adb262990 | |
hxxp://kkk[.]no-ip[.]biz | C&C |
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…