Alert for Weaponized TeamViewer Installer that delivers njRAT

Alert for Weaponized TeamViewer Installer that delivers njRAT 

Hazard actors relying on legitimate, 9aaf3f374c58e8c9dcdd1ebf10256fa5 software Team Viewer for exploitation has been a totally commonplace situation. There have been numerous cases in which risk actors used 9aaf3f374c58e8c9dcdd1ebf10256fa5 software to deliver malware to the sufferers. In addition, a latest file from Cyble research & Intelligence Labs stated that the maximum popularly used remote computing device support software program, “Team Viewer” has been exploited by threat actors to deliver njRAT malware. Other software that become turning in njRAT malware include Wireshark, system Hacker, and so on., NJ RAT is a far flung get admission to Trojan that could perform keylogging, password stealing, facts exfiltration, gaining access to webcams, and microphones, downloading extra documents, and plenty of others. It changed into first determined in 2012 and was attacking companies in middle Japanese countries.

Weaponized TeamViewer Installer

The initial degree of compromise for njRAT entails conventional strategies like phishing campaigns, cracked software on document-sharing websites, and power-by downloads. Further to this, the malware is now being allotted thru trojanized packages. Once the malware is executed, it drops two documents at the C: home windows folder in which, certainly one of them is the njRAT malware.

The Installer then triggers the malware “Team Viewer starting.exe” and in the end launches the valid “teamviewer.exe” software. In the course of the installation of Team Viewer, njRAT simultaneously begins the installation with the aid of copying itself to the AppDataLocalTemp folder with the name “system.exe.”

It then executes the newly dropped record, and njRAT creates a mutex.

Post Exploitation and persistence

njRAT modifies the “SEE_MASK_NOZONECHECKS” environment variable in home windows, which prevents protection caution prompts or dialog boxes from being provided to the consumer, thereby operating with none challenge. Moreover, the malware additionally changes the Firewall regulation to permit communications with the C2 (Command and manipulate) server. The malware creates auto run entries inside the gadget registry to maintain persistence in the system. The malware then collects information approximately Keystrokes, windows OS model, carrier %, webcam statistics, the modern date, username, system architecture, and precise registry keys.

It stores all of this statistics within the “%appdata%/temp” folder under the filename “system.exe.tmp”.