Loading malware…
JSSLoader is a Windows remote access trojan with payload-loading functionality, first observed in September 2019. It is associated with the financially motivated FIN7 group, also tracked as Sangria Tempest, ELBRUS, and Carbon Spider. Storm-0324, which overlaps with TA543 and Sagrid, distributes JSSLoader to establish access that can subsequently be transferred to ransomware operators. GOLD NIAGARA has also used the malware. Distribution campaigns have targeted organizations across finance, manufacturing, technology, retail, healthcare, education, and transportation.
JSSLoader profiles compromised hosts, collecting information about users, domains, drives, running processes, installed applications, network configuration, and desktop contents. It transmits collected information to command-and-control infrastructure and accepts commands to execute scripts, programs, and additional payloads. Its functionality includes data exfiltration, self-updating, and removal of the implant and its persistence. Observed variants establish persistence through startup shortcuts or registry run entries. Originally implemented in .NET, JSSLoader was rewritten in C++ for campaigns in June 2021; subsequent campaigns also used .NET variants. Evasion techniques include string encoding, runtime string reconstruction, changing identifiers, and system-uptime checks intended to hinder analysis.
Delivery commonly involves invoice-, payment-, or package-themed phishing emails containing malicious attachments or links to landing pages and SharePoint-hosted archives. Infection chains use obfuscated scripts, malicious Office documents, or Excel add-ins that download and execute the implant after user interaction. FIN7-linked campaigns have also used spearphishing. From July 2023, Storm-0324 expanded distribution to phishing messages sent through Microsoft Teams. JSSLoader provides an early foothold for additional tooling and downstream ransomware attacks rather than performing ransomware encryption itself.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Storm-0324 is distributing the JSSLoader before passing the buck to other ransomware groups.”
“Storm-0324 is distributing the JSSLoader before passing the buck to other ransomware groups.”
Researchers report a new version of the JSSLoader remote access trojan being distributed via malicious Microsoft Excel addins.
After a months-long absence, the malware loader JSSLoader returned in June 2021 campaigns rewritten from the .NET programming language to C++. JSSLoader is often dropped in the first or second stage of a campaign and has the functionality to profile infected machines and load additional payloads.
After a months-long absence, the malware loader JSSLoader returned in June 2021 campaigns rewritten from the .NET programming language to C++. JSSLoader is often dropped in the first or second stage of a campaign and has the functionality to profile infected machines and load additional payloads.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Storm-0324 manages a malware distribution chain and has used exploit kit and email-based vectors to deliver malware payloads.
The original delivery mechanism was unavailable for analysis, but the add-ins were reportedly delivered via invoice-themed emails. This approach is consistent with previous GOLD NIAGARA activity.
Earlier this year Morphisec and Secureworks described a new component used by this group, delivered in XLL format. That element was the first step in the attack chain leading to another malware, dubbed JSSLoader.
The email contained URLs linking to a Keitaro TDS landing. In turn, the landing linked to the download of a Windows Scripting File (WSF) hosted on SharePoint.
In July 2023, Storm-0324 began using phishing lures sent over Teams with malicious links leading to a malicious SharePoint-hosted file. For this activity, Storm-0324 most likely relies on a publicly available tool called TeamsPhisher.
The JSSLoader RAT can harvest data about the compromised system and send it to a command and control (C2) server, run commands, download additional malicious payloads, and execute files.
the XLL files use malicious code inside an xlAutoOpen function
Its commands and functionality focused on executing a next stage executable or JavaScript.
If executed, it downloaded an intermediate script, which then downloaded and executed the C++ version of JSSLoader.
the threat actors use an unsigned file, so Excel will show the victim a clear warning about the risks of executing it. When enabled, the XLL files use malicious code inside an xlAutoOpen function
These infections have been utilizing Microsoft Excel add-in files (XLL files) to drop the JSSLoader trojan to victim machines.
It sets up “registry run” persistence using a value name of “AppJSSLoader”
The malware uses Windows shortcut (.lnk) files for persistence.
It sets up “registry run” persistence using a value name of “AppJSSLoader”
The malware uses Windows shortcut (.lnk) files for persistence.
The .NET code lacks robust obfuscation, instead relying on variable .NET class and function names, simplistic encoding and decoding functions, a large number of unused strings, and string splitting/concatenation to avoid reliable detection.
In some cases, Storm-0324 uses protected documents for additional social engineering... The password also serves as an effective anti-analysis measure because it requires user interaction after launch.
The XLL files analyzed by CTU™ researchers use the ExcelDna.xll filename, possibly to mimic a legitimate Excel add-in project of the same name.
The threat actor regularly refreshes the User-Agent on the XLL files to evade EDRs that consolidate detection information from the entire network
the new RAT has split the strings into sub-strings and concatenates them at runtime
Storm-0324 has used a variety of files to host the JavaScript code, including WSF and Ekipa publisher files exploiting the CVE-2023-21715 local security feature bypass vulnerability.
Windows System Discovery Using ldap Nslookup
Once executed, JSSLoader collects basic system information, sends the information to the C2 server, and then waits for commands.
including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.
fin7 jssloader sacl event accessing browser sql db for collection of data to exfiltrate.
Users are ultimately redirected to a SharePoint-hosted compressed file containing JavaScript that downloads the malicious DLL payload.
The JSSLoader RAT can harvest data about the compromised system and send it to a command and control (C2) server... Once executed, JSSLoader collects basic system information, sends the information to the C2 server, and then waits for commands.
Its C&C used HTTPS requests with base64-encoded data
If the user enables the add-in, its code executes within the context of the Excel process, attempts to download a JSSLoader binary to the %TEMP% directory, and then executes the binary.
Its C&C used HTTPS requests with base64-encoded data
JSSLoader is a small, lightweight RAT that can perform data exfiltration
54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.