Cybersecurity researchers from Pavilion have recently uncovered a new malware campaign in which Russian malicious actors allegedly target other Russians.
As reported by researchers Matt Stafford and Sherman Smith, in early November, the company spotted a lightweight, but highly potent JavaScript Remote Access Trojan (RAT), that was being deployed together with a C# keylogger which it has called “DarkWatchman”.
It is being distributed in a similar fashion to most malware today - through phishing emails. An email with a ZIP attachment would be sent out, containing what seems to be a text document. In reality, however, the file is a self-installing WinRAR archive that deploys both the RAT and the keylogger.
DarkWatchman is quite cheeky, the researchers further explained, as it does not store logged keys on the disk, but rather uses the Windows Registry fileless storage. The Trojan sets up a scheduled task, to run itself every time the victim logs into Windows.
Enabling ransomware attacks
After logging, it will execute a PowerShell script to compile the keylogger and launch it into memory.
"The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it," the two researchers explained.
"The keylogger itself does not communicate with the C2 or write to disk. Instead, it writes its keylog to a registry key that it uses as a buffer. During its operation, the RAT scrapes and clears this buffer before transmitting the logged keystrokes to the C2 server."
Speaking of the C2 server, DarkWatchman uses domain generation algorithms (DGA), generating up to 500 domains every day. That, the researchers explained, makes them highly resilient to domain seizure, and resistant to communication monitoring.
DarkWatchman has a very specific use case, Prevailion researchers believe. According to them, the RAT was designed by ransomware operators and distributed to third parties, who are then tasked with compromising target networks. Once the RAT is deployed, installing the actual malware becomes a lot easier.
- You might want to check out our list of the best endpoint protection software available today
