NjRat campaign coming from Saudi Arabia is using old FakeAv tactics

Pierluigi Paganini June 02, 2015

Security experts discovered a new njRat campaign using old tactics, making use of compromised websites as a third layer, communication proxy.

A recent post published on http://blog.0x3a.com/ it was described a new njRat campaign using old tactics, making use of compromised websites as a third layer, communication proxy.

Using FakeAV tactics was in vogue some years ago, but it seems that not all of them disappeared, and the last post on http://blog.0x3a.com proves exactly that. The infection can arrive from almost any “corner” of the web, like SPAM emails, Chat messages, SMS, etc. etc., but in the case of this post, it wasn’t given any news about the received method.

When visiting the compromised and indicated website the user is greeted with a pop-up alert:

njRat fake 2

As a typical FakeAV after a pop up like the one above the browser will show like a Windows XP alike My computer and will say that the PC is full of virus

njRat fake 3

And when clicking any of the buttons of the page software called “Antivirus2015.exe” will be downloaded:

facebook phishing 4

When running the fake antivirus so-called “Antivirus2015.exe” a pop-up will appear with fragmented English (what is strange for an AV brand…) saying “Your Computer not found of virus”

njRat fake 6

One of the persistent methods of this FakeAV it’s that he adds itself in the startup, to be able run ever time you turn on the PC, via MSConfig it can be seen a new entry:

njRat fake 7

Investigating further, the author went to check the code and found out that the “main” function does:

  • Display the popup with the message
  • Make sure the application (and its icon) isn’t shown in the taskbar
  • Decode a string of text (under Label_004D) which contains a link to a pastebin post
  • Download whatever is at this pastebin link
  • Use the content of the pastebin post as another URL and download data from it
  • The data obtained from the link inside the pastebin post are written to ’%temp%/notepad.exe’
  • Execute the ’%temp%/notepad.exe’ payload

The origin of this FakeAV comes from Saudi Arabia, exactly from the IP 188.55.84.43:
njRat fake 8

As a concluding note, let me say that the old methods of 2005 can be called the new methods of 2015. because random users can forget old threats, or because it was from 10 years ago, or because they never face it before, but keep in mind that old methods are coming back to life, like the case of Excel/Word macros.

You can check the full post by checking the blog here: http://blog.0x3a.com/post/120423677154/unusual-njrat-campaign-originating-from-saudi

About the Author Elsio Pinto

Elsio Pinto (@high54security) is at the moment the Lead Mcafee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog http://high54security.blogspot.com/

[adrotate banner=”9″]

Edited by Pierluigi Paganini

(Security Affairs – njRat,  cybercrime)

[adrotate banner=”12″]



you might also like

leave a comment