Zscaler Blog

Introduction

In June of 2023, our research team at Zscaler ThreatLabz discovered a threat actor targeting FinTech users in the LATAM region. JanelaRAT involves several tactics, techniques, and procedures (TTPs) such as DLL side-loading, dynamic C2 infrastructure, and a multi-stage attack.

The final malware involved in this campaign is a heavily modified variant of BX RAT. Because of this, we named the malware: JanelaRAT.

This technical blog covers:

• Key Takeaways
• Attack Chain
• Technical Analysis
• Self-Defense Mechanisms
• Network and Communication
• Capabilities 
• Relationship with BX RAT
• Our Findings on JanelaRAT
• Conclusion
• Zscaler Coverage
• Indicators of Compromise (IOCs)
• Appendix - Python Scripts to Help You Approach JanelaRAT

Key Takeaways

• Financial Data in LATAM: As of June 2023, JanelaRAT mainly targets financial and cryptocurrency data from LATAM bank and financial institutions.

• New, Nefarious Capabilities: JanelaRAT features a windows titles sensibility mechanism that allows the malware to capture window title data and send it to the threat attackers.

• Strategic and Exploitative Behavior: JanelaRAT employs a dynamic socket configuration system. The C2 infrastructure used by the threat attackers heavily abuses dynamic DNS services. Each domain is set up in the infrastructure to be active only on a certain day of the month.

• Evasive Maneuvers: JanelaRAT abuses DLL side-loading techniques from legitimate sources (like VMWare and Microsoft) to evade endpoint detection.

• Origin of Threat Actor: The developer of JanelaRAT is Portuguese-speaking. There is heavy use of Portuguese in the malware strings, metadata, decrypted strings, etc. 

Attack Chain

This campaign involves a multi-stage infection chain with a moderate complexity level.

1. The attack chain is kick started by a VBScript sent inside ZIP archives. (At the time of writing this blog, we do not know exactly how these ZIP archives were distributed to the users.) 
2. The VBScript performs two key actions:
   • It fetches a ZIP archive from the attackers' server
   • It drops a BAT file on the endpoint to prepare the system for the next stage of infection
3. The ZIP archive contains two components which are responsible for carrying out the rest of the infection chain and accomplish DLL side-loading.

The image below is a high-level view of the campaign’s attack chain. 

_{Figure 1: End-to-end attack chain of the campaign used to distribute JanelaRAT}

Technical Analysis

Scripts

VBScript Analysis

For the purposes of technical analysis, we used this VBScript with MD5 hash:

24c6bff8ebfd532f91ebe06dc13637cb

The code obfuscation in the VBScript is very primitive. After decoding all the strings in the VBScript, its purpose became evident to our team.

The main operations performed by the VBScript are as follows:

1. Drops a BAT file in the path: C:\Users\Public\ with a randomly generated 7-character alphanumeric name. 
2. Downloads content from the URL: hxxp://zimbawhite.is-certified[.]com:3001/clientes/6 and parses it to extract a base64-encoded ZIP archive.
3. Base64 decodes the content and saves the ZIP archive with a randomly generated 8-character alphanumeric file name.
4. Executes the BAT file.
5. Sleeps for 5 seconds and restarts the victim's machine.

We observed that the URL used to download the base64-encoded ZIP archive was actually hosting 44 different variants of the archives, all stored base64-encoded. Since the URL was active at the time of our analysis, we were able to download all 44 variants of the ZIP archives. A Python script is included in the Appendix section of this blog to help you automate this process.

The image below shows the web response when the URL is accessed directly without specifying the index. The response contains all 44 ZIP archives base64-encoded.

_{Figure 2: Base64-encoded ZIP archives received in web response from attacker's server}

All these ZIP archives include components with different file hashes but similar functionality. This indicates that the main purpose of this method is evasion of file hash-based detection.

Batch Script Analysis

The purpose of the batch script is to set up a persistent mechanism so the JanelaRat sample is automatically launched at each system reboot. This is achieved by:

1. Setting up a so-called RunKey. This allows a particular registry key hosting the path to a file and granting that file execution at reboot time.
2. The batch script set the RunKey to the legitimate executable included in the second compressed archive.
3. The execution of that file will cause the loading and execution of the JanelaRAT DLL.

The key name (MicrosoftEdgeAutoLaunch_) was chosen so it can appear innocuous, like the legitimate RunKey for the Microsoft Edge browser. 

DLL side-loading

JanelaRAT comes in the form of a DLL side-loaded by a legitimate executable. Depending on the legitimate executable employed in the attack, the DLL may have different names.

We discovered these two:

• VCRUNTIME140.dll: side-loaded by vmnat.exe
• msedge_elf.dll:  side-loaded by identity_helper.exe

The legitimate executable, which is included in the compressed archive with JanelaRat, is usually renamed.

In the table below, you can see metadata information of the JanelaRAT sample we used for technical analysis in this section

The DLL was developed in C# for Microsoft .NET 4.0 and the source code is protected by Eazobfuscator - a commercial code obfuscator for .NET assemblies.

The image below shows the assembly metadata containing clear-text strings in Portuguese, supporting our hypothesis about the threat attacker's intention to make JanelaRAT seem like a real cybersecurity tool. For instance:

• "Firewall de Rede" means network firewall
• "Plataforma de Segurança Mulitcanal" means multichannel security platform
• "Ferramenta de Segurança Inteligente" means smart security tool
• "Análise de Segurança de Banco de Dados" means database security analysis

At a glance, these seemingly legitimate security strings can make JanelaRAT appear like a real cybersecurity tool.

_{Figure 3: JanelaRAT impersonating as a cybersecurity tool using well-crafted metadata}

Self-Defense Mechanisms

String encryption

Most of the JanelaRAT strings are encrypted and stored in a dedicated class as a form of anti-analysis. Each field of this class contains either an encrypted string or an array of encrypted strings. The string decryption algorithm can be broken down in the following steps:

1. The encrypted string is decoded using base64.
2. Once decoded, the string is decrypted. The decryption algorithm is Rijndael AES in Cipher Block Chaining (CBC) mode.
   • The decryption key is always the same for all the strings and, to the best of our knowledge, it is the same across the samples: the MD5 of the string 8521.
   • The Initialization Vector (IV) varies for each string, being set to the first 16 bytes of the string decoded in the point above. The decryption is only applied to the remaining bytes.

We provide a Python implementation of this algorithm in the Appendix section of this blog.

Idle if inactive

JanelaRAT utilizes a basic self-protection mechanism to mitigate the risk of being detected.

• Every 5 seconds the malware checks the time elapsed from the system start to the last input event that occurred on the infected system.
• If this time span exceeds 10 minutes then the malware transitions into an idle state.
• While in the idle state, JanelaRAT stays silent by not exposing any unnecessarily risky behavior that might arouse suspicion.

The image below shows the method used to perform the inactivity check. The method call is a wrapper around the GetLastInputInfo native API, responsible for instantiating a LASTINPUTINFO data structure. The dwTime field of such a structure contains the milliseconds elapsed since the last input event. The method returns true if the amount of time passed from the system start (Environment.TickCount), to the last input received (dwTime), exceeds 10 minutes.

_{Figure 4: JanelaRAT checks if the infected system has been inactive (no input events) for more than 10 minutes}

In the image below, you can see that:

• if the check returns true, the malware sets its internal state to "Idle" 
• if the check returns false, the malware sets its internal state to "Active" 

The state transition, regardless if true or false, is communicated to the threat attacker through the C2. You can see this in action in the image below.

_{Figure 5: JanelaRAT communicating state transition to threat actors using C2}

Network and Communication

C2 check-in

Once it gets started, JanelaRAT makes a request to register the newly-infected host to the threat attacker’s network.

• The C2 domain is always the same: cnt-blackrock.geekgalaxy[.]com 
• The HTTP verb is GET
• The User-Agent is hardcoded and rather peculiar: VisaoAPP

The image below shows that the GET request consists of four parameters.

_{Figure 4: JanelaRAT checks-in to the attacker's network of compromised hosts}

The malware makes this request attempt only if it doesn’t find a file named fi.ini in the temporary files directory. Any response from the server isn't handled.

C2 rotation and communication

The JanelaRAT configuration contains 32 domains used for C2 communication. Those domains are encrypted with the algorithm described earlier in the String Encryption section. The selection in that array is guided by the day of the month when making the request.

For example, the following table shows the domain array for all the JanelaRAT samples we analyzed.

As you may notice, there is an extra domain at index 0 that will never be used by the C2 domain rotation algorithm. Furthermore, the domains for day 30 and day 31 are the same. 

The C2 channel is implemented as a socket opened to the resolution IP of the daily C2 domain. The socket port is obtained by making a request for a text file named 16Psyche.txt. This file contains just the port, encrypted with the algorithm discussed in the String Encryption section.

JanelaRAT implements a custom protocol to communicate with the C2. This protocol is defined by a hierarchy of classes representing the type of messages expected to be exchanged between the malware samples and the C2 server. We call those messages "packets" because this feature was imported from BX Rat, where all those classes implement the same interface called "packet". We found packets for:

• mouse inputs
• keyboard inputs
• screenshot captures
• and more

When any of those packets is instantiated to be shipped through the C2 channel, the instance is:

• serialized into an array of integers
• encrypted with a custom implementation of RC4 with key 8521
• compressed with a custom implementation of the LZ4 algorithm
• eventually sent through the C2 channel

The image below shows an example a packet class representing a sequence of keystrokes sent by the threat attacker to the malware so that they can be sent to the targeted window. This class defines specific fields (e.g., the string containing the keystrokes) with a method responsible for implementing the communication procedure.

_{Figure 5: Example of packet class used by JanelaRAT to implement its C2 communication procedure}

Capabilities

Capture and check window data

JanelaRAT captures the content of windows title bars and checks if they are interesting for the threat attacker. "Interesting" titles will be related to financial and banking data.

The malware implements a periodic behavior triggered every second and consists of three consecutive stages.

Stage 1

At the first stage, JanelaRAT checks if it obtained a list of interesting title bars. If not, then the malware requests a text file named kepler186f.txt to the C2. The content is encrypted with the same algorithm used for the strings. (Since the campaign was still active at the time of analysis, we were able to download an instance of such a file.) Once decrypted, you can see that it consists of a pipe-separated ("|") list of capitalized windows titles.

You can see an excerpt of the decrypted content in the box below.

Kepler186f.txt file content is parsed as an array of strings and stored as a class field for future use.

Stage 2

At the second stage, JanelaRAT checks the same DLL directory for the block.blq file. This file has a slightly different structure compared to the kepler186f.txt file. It is still composed of a single, pipe-separated, record but it only contains three fields: 

• a timestamp,
• a base64-encoded image
• a list of dash-separated ("-") window titles

The image below shows a snippet, belonging to the malware code, implementing the parsing logic for block.blq. If the file is outdated, then the malware deletes it. 

_{Figure 6: JanelaRAT code snippet implementing the parser for block.blq file content}

The window titles included as the third field in block.blq are titles of windows the attacker wants to block. When the title of the foreground window is included in the block.blq, the malware attempts to close it. The blocking mechanism is implemented by invoking the SendMessage API with WM_CLOSE value for the Msg argument. JanelaRat also visualizes a dialog to the victim showing a fake error message.

Stage 3

At the third stage, the malware checks if the title of the window in the foreground is appealing. The check is made after grabbing the title, capitalizing it, and eventually dropping all non-alphabetical characters. By "appealing", we mean what was discussed at Stage 1  (i.e., the title was in a previously parsed instance of kepler186f.txt). If the check succeeds, JanelaRAT opens a C2 channel in the form of a socket as discussed earlier. This channel is later used for alerting the threat attacker about the victim opening interesting windows, sending key logs, mouse clicks, and implementing remote desktop sessions.

Acquire host profile details

JanelaRAT is capable of collecting and sending information about the compromised host to the attacker. This information is encapsulated in a packet containing the fields reported in the following table. As you can see, the field names don't always correlate with their actual content. Moreover, some fields are left to the default values. Those aspects suggest that the original malware source code has been eventually modified or repurposed to fit the new needs of the operator.

Track mouse movements

JanelaRAT is capable of sending mouse activity to through C2. It defines a packet class containing the following fields:

• x-position of the cursor
• y-position of the cursor
• a boolean value set to true if the left button of the mouse is clicked
• a boolean value set to true if the left button of the mouse was double clicked

Once serialized, an instance of this class is shipped.

Track system usage

JanelaRAT is capable of gathering additional information about the infected system usage.

The malware assembles an array of strings containing the elements shown in the table above. Once assembled, the array is sent to the C2.

Open message boxes on the infected system

JanelaRAT gives a threat attacker the ability to open message boxes on the infected system, which may influence the behaviour of the user. After having shown the message box, the malware sends an acknowledgment to the C2. The acknowledge is another packet class containing a single field of type string called "Message" and instantiated with the value Mensagem mostrada ("Message shown" in Portuguese).

Perform actions

JanelaRAT is capable of performing a wide range of actions on the attacker’s behalf. Those actions are identified by an integer number called "Mode". 

After an action is performed, with the exception of Mode 99, the malware sends a notification to the C2 by encapsulating Mode as the field of a packet class and shipping the serialized instance.

Capture screenshots

JanelaRAT is capable of capturing and shipping screenshots. It defines an packet class containing three fields:

• Janela (window, in Portuguese): Integer dictating the type of screenshot operation being requested. If Janela is set to 1, the malware captures a magnified screenshot. If Janela is set to 2, then the malware live-captures a screenshot and sends it through the C2.
• Mode: Integer that controls the encoding of the captured screenshot. If this field is set to a value bigger than 10, then the screenshot is encoded as a PNG, otherwise it is encoded as a JPG.
• Number: This field is not used.

Run in special execution modes

JanelaRat ships with the capability of running in special execution modes. Each execution mode affects the malware behaviour and it is identified by a label. The attacker may request the malware to operate in any of those modes.

As an example, when in _blcoqueio_tempo_determinado mode, the malware creates a new block.blq file with a limited duration in minutes. The purpose of this behaviour is to temporarily prevent the user from opening windows with specific titles. The file is created only if it doesn’t already exist in the malware directory.

When in _modal_inicial mode, the malware shows a modal dialog that forces the user to interact with the malware by disabling user interaction with the main window. The foreground image for the dialog is obtained from C2. The malware registers a hook for both keyboard and mouse events. 

When in _modal_win_update mode, JanelaRAT displays a fake alert warning the user to not shut the system down while the Windows updates are in progress. Most likely, this allows the attacker to operate on the compromised host while the fake warning is shown to the user.

Finally, when in _modal_loading, modal_error, or modal_tocalm, JanelaRAT operates in the same way: it shows an attacker-provided image to the user. The image is different in each mode, but we weren't able to obtain any of those at the time of analysis.

Relationship with BX Rat

BX Rat is a malware discovered in 2014 and is a fully-fledged Remote Access Trojan (RAT). BX Rat is capable of:

• shell command execution
• file download/upload
• directory exploration
• processes enumeration and killing
• process creation
• system information gathering
• remote desktop control
• and more

_{Figure 7: BX Rat event handlers - which indicate functionalities}

Similarities between BX RAT and JanelaRAT

The threat attackers who created JanelaRAT took strong inspiration from the BX RAT code. In this section, we discuss similarities between BX RAT and JanelaRAT. 

For BX Rat, we use an unpacked sample in circulation since 2014. The hashes are listed below: 

C2 communication procedure

We believe the JanelaRAT developer imported the C2 communication procedure from BX Rat. As shown in the image below, BX RAT serializes a packet instance as an array of integers. This array is later encrypted and finally compressed with a custom implementation of the LZ4 algorithm. The same we observed in JanelaRAT. The encryption algorithm, at least in this BX RAT sample, is a different one since it consists of a custom implementation of AES instead of RC4 - like in JanelaRAT.

Regardless, the two images below show the similarity between the BX RAT C2 transmission procedure (top) and the corresponding code in JanelaRAT (bottom). 

_{Figure 8:  BX RAT serializes a packet instance as an array of integers}

_{Figure 9: JanelaRAT serializes a packet instance as an array of integers}

LZ4 Algorithm

The custom implementation of the LZ4 algorithm is the same in BX RAT (top image) and JanelaRAT (bottom image).

_{Figure 10: Excerpt of BX Rat custom implementation of LZ4 compression algorithm}