Severity
High
Analysis Summary
A new RAT called “JhoneRAT” is found infecting Middle Eastern targets via malicious Microsoft Office documents. The dropper, along with the Python RAT, attempts to gather information on the victim’s machine and then uses multiple cloud services: Google Drive, Twitter, ImgBB and Google Forms. The RAT attempts to download additional payloads and upload the information gathered during the reconnaissance phase. The target filtering is performed by checking the keyboard layout of the infected systems. Based on the analysed sample, JhoneRAT targets Saudi Arabia, Iraq, Egypt, Libya, Algeria, Morocco, Tunisia, Oman, Yemen, Syria, UAE, Kuwait, Bahrain and Lebanon. Three malicious Microsoft Office documents are found that exploit the vulnerability CVE-2017-0199.
CVE-2017-0199
This vulnerability allows remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.” Affected products are Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1 and Windows 8.1
Impact
- Unauthorized Remote Access
- Data exfiltration
Indicators of Compromise
MD5
- 4ae4e0f8747a27f41e444fbc047f0191
- bdd38fdc1c057ccfa416abafa46f0e84
- 089531d78aad6a897c041e7270feea2b
- 7ef4accc31ccbce777cbde68ffa1caec
- 1807e27f6badbb199e95e6d3abdae1dc
- f2e741253b8085bc9e738cc5ae50e735
- 7c487d8462567a826da95c799591f5fb
SHA-256
- 273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f
- 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69
- d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079
- 4228a5719a75be2d6658758fc063bd07c1774b44c10b00b958434421616f1548
- b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366
- 6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4
- 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091
SHA1
- a1b70f143cb91d8ad16ab2ebb109517632e36ce6
- 6ac3fd0b6984cd05ca2a0062a7be2f4e49d5c19d
- c33930f7f38f7ece2cad3a4cb11308c07e47eeb1
- a00cbf454c6b8db90fe5e8480e7f03b73f4e6873
- 579c10219b962b96a5f84010f29eba2c387ef4c5
- 0ce95e5bdd8ff77f0d3e208f168a1aa943c4a920
- 7551f49c26c17ad60e97112cbad4a97ab130545f
Remediation
- Block the threat indicators at their respective controls.
- Do not download files attached in untrusted emails.
- Do not download random files from untrusted sources on the internet.
- Update the affected products to a patched version.