The Cybereason Global Security Operations Center (SOC) issues Cybereason Threat Alerts to inform customers of emerging impacting threats. The Alerts summarize these threats and provide practical recommendations for protecting against them.
The Cybereason GSOC Managed Detection and Response (MDR) Team is investigating a series of recent infections that use a code that a malicious actor has implanted in UAParser.js, a JavaScript library that parses User-Agent data. Users can install UAParser.js on systems as an npm package using the npm JavaScript package manager. The implanted malicious code deploys cryptocurrency-mining and information-stealing malware on compromised systems.
A malicious actor has compromised the npm account of a UAParser.js developer and has implanted malicious code in the source code of UAParser.js, which is distributed as an npm software package. This means that users who install the compromised UAParser.js npm package execute the implanted malicious code.
The implanted malicious code in the compromised UAParser.js npm package runs a script named preinstall.js:
The malicious code runs the preinstall.js script
The preinstall.js script first determines the type of the operating system on which the script runs. The preinstall.js script runs a Windows Batch script named preinstall.bat on Windows systems, and runs a Linux Shell script named preinstall.sh on Linux systems:
preinstall.js runs preinstall.bat or preinstall.sh
The preinstall.bat and preinstall.sh scripts download and execute malicious executables named jsextension.exe and jsextension, respectively, from an attacker-controlled endpoint with an IP address of 159.148.186[.]228, located in Latvia. The jsextension(.exe) executables implement cryptocurrency-mining malware:
preinstall.bat uses the curl, certutil or the wget utility to download jsextension.exe
On Windows systems, in addition to jsextension.exe, preinstall.bat downloads a malicious executable named create.dll from an attacker-controlled endpoint, citationsherbe[.]at, located in Russia. The create.dll executable is a Windows dynamic-link library (DLL) with a SHA-256 hash of bb8ccdcf17761f1e86d8ebbc1a12b123929c48c5eea4739b7619bd53728d412b. The create.dll file implements information-stealing malware.
After preinstall.bat downloads jsextension.exe and create.dll, it uses the tasklist Windows utility to determine whether jsextension.exe is already running on the compromised system. If jsextension.exe is not running, preinstall.bat executes first jsextension.exe and then create.dll by using the regsvr32.exe Windows utility:
preinstall.bat executes jsextension.exe and create.dll
Cybereason recommends the following:
Gal Romano, Senior Security Analyst, Cybereason Global SOC
Gal Romano is a Senior Security Analyst with the Cybereason Global SOC (GSOC) team. He is involved in malware analysis, mobile malware analysis, and threat hunting activities. Gal was involved in several milestone projects in Cybereason, such as the SOC Extended Detection and Response (XDR) initiative.
Rotem Rostami, Security Analyst, Cybereason Global SOC
Rotem Rostami is a Security Analyst with the Cybereason Global SOC (GSOC) team. She is involved in malware analysis activities and triages security incidents effectively and precisely. Rotem has a deep understanding of the malicious operations prevalent in the current threat landscape. Rotem has been working in the cybersecurity industry since 2018.
Aleksandar Milenkoski, Senior Threat and Malware Analyst, Cybereason Global SOC
Aleksandar Milenkoski is a Senior Threat and Malware Analyst with the Cybereason Global SOC (GSOC) team. He is involved primarily in reverse engineering and threat research activities. Aleksandar has a PhD in system security. Prior to Cybereason, his work focused on research in intrusion detection and reverse engineering security mechanisms in the Windows 10 operating system.
The Cybereason Global SOC Team delivers 24/7 Managed Detection and Response services to customers on every continent. Led by cybersecurity experts with experience working for government, the military and multiple industry verticals, the Cybereason Global SOC Team continuously hunts for the most sophisticated and pervasive threats to support our mission to end cyberattacks on the endpoint, across the enterprise, and everywhere the battle moves.
All Posts by Cybereason Global SOC Team
In this edition of the Blue Team Chronicles, we assess the capabilities of eslogger, a new built-in macOS tool, and show how defenders can use this tool to better understand malicious activities on macOS and build new detection approaches...
In certain combinations, some chains of behavior represent an advantage to an attacker - your team must be able to differentiate between benign use vs. the abuse of legitimate tools and processes...
