Escalation in JScript RAT Deployment via Phishing
Date:
10-Jun-2024
Label:
Trends
Threat Level:
Medium
A trend of deploying JavaScript-based Remote Access Trojans via phishing campaigns persists, leveraging a two-tiered attack approach. The initial loader, heavily obfuscated, decrypts to execute a script that reaches out to a C&C server, retrieving a malicious JScript. This initial contact sets the stage for the attack's second wave.
The second stage leverages WinHttpRequest to fetch an RC4 encrypted binary from the C&C server, evocative of Cobalt Strike's advanced payload delivery. After decryption, this payload reveals the RAT, enabling attackers to execute commands and maintain persistence on the victim's machine.