JanelaRAT Evolves Its Delivery Chain and Enables Live Banking-Session Hijacking
Summary
The analysis details JanelaRAT’s evolving infection chain and its use of overlays, input injection and remote control to hijack banking sessions. 2025 telemetry recorded thousands of detections in Brazil and Mexico.
Key points
- Phishing lures lead victims through staged downloads to an MSI dropper that installs JanelaRAT as PixelPaint.dll and sideloads it through the legitimate nevasca.exe.
- The malware establishes persistence through Windows Startup items and uses .NET obfuscation, encrypted strings and sandbox checks to hinder analysis.
- JanelaRAT monitors targeted banking windows and can display fake overlays to capture credentials and MFA tokens, as well as capture screens, log keystrokes and inject keyboard or mouse input.
- The malware reports victim and anti-fraud software information to rotating C2 infrastructure; the analyzed variant uses dynamic DNS and communicates over port 443 without TLS.
- The article reports 2025 telemetry of 14,739 JanelaRAT-related detections in Brazil and 11,695 in Mexico.
- The article recommends blocking dynamic DNS services at corporate perimeters or internal DNS resolvers to disrupt JanelaRAT C2 communications.
Article Details
- Attack Vectors
- Phishing emails mimicking pending-invoice delivery direct victims to a malicious link, which leads to a website distributing compressed files and the malware infection chain.
- An MSI dropper installs JanelaRAT as PixelPaint.dll and uses the legitimate executable nevasca.exe to load it through DLL sideloading.
- The dropper creates a Startup-folder shortcut, and the malware can also write a command script to the Windows Startup directory for persistence.
- JanelaRAT uses banking-themed overlays to capture credentials and MFA information, captures keystrokes and screenshots, and injects keyboard or mouse input.
- The malware communicates with C2 infrastructure over TCP and HTTP; one variant constructs a daily rotating C2 domain using a dynamic DNS suffix.
- Defensive Notes
- The article recommends blocking dynamic DNS services at the corporate perimeter or internal DNS resolvers to disrupt JanelaRAT C2 communications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ciderurginsx[.]com | Reported primary C2 domain for JanelaRAT. |
| MD5 | 808c87015194c51d74356854dfb10d9e | MD5 hash identified in the article for a JanelaRAT MSI dropper. |
| MD5 | d7a68749635604d6d7297e4fa2530eb6 | MD5 hash identified in the article for a JanelaRAT DLL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationJanelaRAT uses Eazfuscator or ConfuserEx obfuscation, renamed classes and variables, and encrypted strings.T1056.001 · KeyloggingJanelaRAT captures keystrokes while monitoring banking activity.T1057 · Process DiscoveryThe malware checks for processes associated with banking security software and reports their presence to C2.T1059.001 · PowerShellA post-exploitation routine executes a downloaded PowerShell script to re-establish persistence by downloading PixelPaint.dll.T1059.003 · Windows Command ShellThe malware's command handler can run CMD scripts or commands.T1071.001 · Web ProtocolsThe malware sends periodic HTTP requests to C2 to report its version and information about the victim machine.T1105 · Ingress Tool TransferThe infection chain downloads additional payloads, including PowerShell and PixelPaint.dll, from staging or C2 infrastructure.T1113 · Screen CaptureJanelaRAT captures desktop screenshots or cropped screen regions and sends them to C2.T1497 · Virtualization/Sandbox EvasionThe malware checks for sandbox or analysis environments using Magnifier and MagnifierWindow components.T1547.001 · Registry Run Keys / Startup FolderThe dropper creates a Startup-folder LNK pointing to nevasca.exe; the article also describes a command script written to the Windows Startup directory.T1566.002 · Spearphishing LinkCampaign emails mimic pending-invoice delivery and direct victims through malicious links to malware downloads.T1574.002 · DLL Side-LoadingThe MSI installs PixelPaint.dll, identified as JanelaRAT, and the legitimate nevasca.exe loads the DLL.
Malware
BX RATJanelaRAT is a modified variant of BX RAT that has targeted users since June 2023.JanelaRATJanelaRAT is a banking-focused remote access Trojan campaign active since mid-2023 that uses multi-stage phishing lures, evolving droppers (including MSI-based sideloading), and dynamic C2 infrastructure to target
Tools
ConfuserExJanelaRAT is a .NET backdoor (obfuscated with Eazfuscator/ConfuserEx) that collects system info, creates a mutex, encrypts strings (Base64 + AES), and establishes TCP/HTTP beaconing to C2 servers that rotate daily usingEazfuscatorJanelaRAT is a .NET backdoor (obfuscated with Eazfuscator/ConfuserEx) that collects system info, creates a mutex, encrypts strings (Base64 + AES), and establishes TCP/HTTP beaconing to C2 servers that rotate daily usingPowerShell[T1059.001 ] PowerShell – Post-exploitation uses a downloaded PowerShell to re-establish persistence and download the PixelPaint.dll: ‘The first subroutine executes a PowerShell downloaded from a staging server during