Cyble researchers uncovered a Trojanized TeamViewer installer that drops njRAT, a Remote Access Trojan, onto Windows machines, leveraging trusted software to lure victims. The campaign enables keystroke logging, data collection, and C2 communication while persisting via startup entries and registry changes. #njRAT #Bladabindi #TeamViewer #CRIL #Cyble #Wireshark
Keypoints
- njRAT is delivered through trojanized TeamViewer installers, exploiting trust in popular apps.
- The malware drops two files in Windows, including a legitimate TeamViewer executable and njRAT.
- njRAT copies itself to AppDataLocalTemp as system.exe to masquerade as a legitimate process and launches it.
- A mutex (301b5fcf8ce2fab8868e80b6c1f912fe) is created to prevent reinfection and coordinate the malicious threads.
- It modifies the registry (SEE_MASK_NOZONECHECKS) to bypass security warnings and prompts.
- Persistence is achieved via two autorun registry entries and a startup-folder copy.
- njRAT performs keylogging and system information collection, encodes data (base64), and exfiltrates to a C2 server.
- The malware establishes a C2 connection using preconfigured address/port and awaits commands.
MITRE Techniques
- [T1204] User Execution – Users are prompted to proceed with the TeamViewer installation via a user prompt window. Quote: “the user prompt window, providing the option to proceed with the team viewer installation.”
- [T1059] Command and Scripting Interpreter – The loader triggers execution of “TeamViewer Starting.exe” (njRAT) and then launches “teamviewer.exe”. Quote: “the installer triggers the execution of “TeamViewer Starting.exe” (njRAT) and subsequently launches the legitimate “teamviewer.exe” application.”
- [T1547] Boot or Logon AutoStart Execution – Persistence via startup mechanisms; two autorun entries and a startup folder copy. Quote: “two distinct methods to achieve persistence. The first one involves creating two autorun entries in the system registry… and the second method entails copying itself to the startup directory.”
- [T1036] Masquerading – The malware copies itself to AppDataLocalTemp with the filename “system.exe” to appear legitimate. Quote: “copying itself into the ‘AppDataLocalTemp’ directory with the filename “system.exe”.”
- [T1082] System Information Discovery – The malware collects OS version, service pack, date, username, webcam info, architecture, and registry keys. Quote: “collects various system information such as the Windows operating system version, the service pack, the current date, the username, information about webcams, system architecture, and specific registry keys.”
- [T1057] Process Discovery – The attack chain shows a sequence of processes involved when executing the Trojanized TeamViewer installer. Quote: “sequence of processes involved when executing the Trojanized TeamViewer installer.”
- [T1012] Query Registry – Registry modification and keys usage (security setting changes). Quote: “changing security settings in the registry.”
- [T1056] Input Capture – Keylogging via a dedicated thread capturing keystrokes and storing them. Quote: “The RAT creates a dedicated thread that establishes an ongoing loop to continuously monitor keystrokes.”
- [T1071] Application Layer Protocol – Data exfiltration and C2 communication over an application-layer protocol. Quote: “establishes a connection with a Command and Control (C&C) server to transmit the gathered information.”
- [T1095] Non-Application Layer Protocol – Preconfigured C2 address/port implying non-application-layer signaling. Quote: “The C&C address and listening port are preconfigured within the file.”
Indicators of Compromise
- [Hash] Trojanized TeamViewer – 224ae485b6e4c1f925fff5d9de1684415670f133f3f8faa5f23914c78148fc31, 9b9539fec7d0227672717e126a9b46cda3315895, and 11aacb03c7e370d2b78b99efe9a131eb
- [Hash] system.exe / TeamViewer Starting.exe – 9bcb093f911234d702a80a238cea14121c17f0b27d51bb023768e84c27f1262a, b2f847dce91be5f5ea884d068f5d5a6d9140665c
- [URL] C2 – hxxp://kkk[.]no-ip[.]biz
Read more: https://blog.cyble.com/2023/07/13/trojanized-application-preying-on-teamviewer-users/