The New Version of JsOutProx is Attacking Financial Institutions in APAC and MENA via GitLab Abuse

MITRE Techniques

• [T1059] Command and Scripting Interpreter – The implant uses Windows Script Host (WSH) objects to perform operations; for example, “it uses WinHttp.WinHttpRequest.5.1 for HTTP requests, WScript.Shell for executing commands, and Scripting.FileSystemObject for file system access.”
• [T1027] Obfuscated/Compressed Files and Information – “The JSOutProx RAT malware features complex obfuscation within its JavaScript backdoor structure” and “obfuscated using obfuscator.io. After deobfuscating them, we obtained the decoded JavaScript code.”
• [T1036] Masquerading – “Solar Spider is employing the classic Masquerading technique (T1036), disguising its code as a PDF file rather than JS code.”
• [T1105] Ingress Tool Transfer – “Most of the identified payloads were hosted on GitHub repositories” (with later use of GitLab in a multi-stage infection chain).
• [T1082] System Information Discovery – “Using WMI, the implant collects information about the victim’s environment.”
• [T1071] Web Protocols – “The unique feature of the malware is its use of the Cookie header field in its command and control (C2C) communication.”
• [T1548.002] By Pass User Account Control – “PriviledgePlugin … UAC allows to write in registry location … and has options for using UAC bypass techniques like fodhelper.exe, Slui File Handler Hijacking, …”
• [T1112] Modify Registry – “ProxyPlugin … modifying registry key ‘SoftwareMicrosoftWindowsCurrentVersionInternet SettingsProxyEnable’.”