DenoRAT

Then, the MSI file writes and executes a Windows batch file. This batch file launches an artificial intelligence-generated PowerShell script named Griffin20.ps1.

Then, the MSI file writes and executes a Windows batch file.

DenoRAT ultimately functioned as a loader for NightshadeC2, receiving a task from the C2 that launched a Python-based in-memory loader to decrypt and execute the NightshadeC2 RAT/infostealer payload.

Once Deno is available, the script runs it with full permissions using deno run -A to fetch and execute the remote launcher.

The attack begins with a ClickFix-style social engineering lure. Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. | Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. This command downloads and runs a Microsoft Installer (MSI) file.

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL

This secondary stager establishes persistence by creating a new registry value in the CurrentVersion Run key.

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL and starts the Chromium-based browser process in a suspended state via CreateProcessW with CREATE_SUSPENDED flag

This secondary stager establishes persistence by creating a new registry value in the CurrentVersion Run key.

It achieves this by injecting a malicious DLL into active Chromium browser processes.

It achieves this by injecting a malicious DLL into active Chromium browser processes.

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL and starts the Chromium-based browser process in a suspended state via CreateProcessW with CREATE_SUSPENDED flag

This secondary stager establishes persistence by creating a new registry value in the CurrentVersion Run key.

The attackers use Obfuscator.io to hide the secondary stager code. This obfuscation greatly complicates the analysis process for incident responders.

It achieves this by injecting a malicious DLL into active Chromium browser processes.

It achieves this by injecting a malicious DLL into active Chromium browser processes.

This script is simply a stager that decrypts and executes the next stage.

This command downloads and runs a Microsoft Installer (MSI) file.

This secondary stager establishes persistence by creating a new registry value in the CurrentVersion Run key.

To prepare for injection, it enumerates running processes matching the browser list below using the Windows APIs CreateToolhelp32Snapshot , Process32First , and Process32Next .

For instance, the “sysinfo” task gathers extensive system details. The malware collects the username, hostname, installed anti-virus software, and hardware configurations.

In the fingerprinting process ( sysinfo task), DenoRAT enumerates over a specific list of directories to identify installed Anti-Virus software.

Additionally, DenoRAT can capture live screenshots of the victim’s desktop. It transmits these images as base64-encoded strings to the server.

Moreover, the “stealer” task targets specific sensitive user data. It extracts information from Chromium and Gecko-based web browsers.

DenoRAT communicates with its command-and-control server using regular HTTP polling.

DenoRAT communicates with its command-and-control server using regular HTTP polling.

This script downloads a Python archive and a reflective PE loader.

vnc-start Stream the victim's desktop and accept remote mouse, keyboard, and clipboard events.

DenoRAT supports both WebSocket and HTTP polling for communication with its C2 server... /message-event POST Data exfil to C2, e.g. victim host information

Matching processes are then opened and terminated using OpenProcess and TerminateProcess .