Researchers Detail JS.MonoGlyphRAT, a JavaScript Backdoor Targeting Businesses
Summary
ANY.RUN researchers detail JS.MonoGlyphRAT, a JavaScript RAT and loader delivered through business-themed phishing attachments. It persists via the Windows registry, communicates over HTTP, and can run PowerShell commands and additional payloads.
Key points
- The malware is delivered as obfuscated JavaScript files disguised as purchase orders, quotes, and other business documents.
- It runs through Windows Script Host, copies itself under the user profile, and establishes persistence with an HKCU Run registry entry.
- Its HTTP C2 protocol uses X-S and X-A headers for session handling and command selection, with communications observed on a non-standard port.
- Supported commands include telemetry collection, remote shell execution, downloading payloads, and loading .NET code in memory.
- The in-memory execution handler can patch AmsiScanBuffer to bypass AMSI scanning.
- Researchers report activity affecting organizations in the US and other countries, but say attribution to a specific actor is unconfirmed.
- Suggested behavioral indicators include wscript.exe spawning PowerShell, suspicious registry writes, and HTTP POST traffic to non-standard ports.
Article Details
- Attack Vectors
- Phishing emails deliver obfuscated JavaScript attachments disguised as purchase orders, quotes, requests for proposals, or requests for quotations.
- The victim executes the attachment through Windows Script Host, launching the MonoGlyphRAT backdoor and loader.
- The malware establishes persistence through the HKCU Run registry key and communicates with its C2 over HTTP, including on a non-standard port.
- C2 commands can make the malware download and execute files or PowerShell commands, or load an additional .NET payload in memory.
- Defensive Notes
- Monitor for wscript.exe executing JavaScript from user-writable directories and spawning PowerShell with -nop and -enc.
- Hunt for new HKCU Run entries pointing to JavaScript files under %USERPROFILE%.
- Monitor HTTP POST traffic to non-standard ports, including requests with ia=, df=, ex=, sb=, or vc= parameters and responses containing X-S and X-A headers.
- Use behavioral detection and sandbox analysis; the article reports that public feeds classify the malware as unknown and that signature-based antivirus provides little protection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aryamint[.]com | Domain identified in the malware cluster's C2 infrastructure. |
| HOSTNAME | scan[.]aryamint[.]com | Hostname identified in the malware cluster's network artifacts. |
| IPV4 | 158[.]94[.]211[.]76 | C2 IP address used for HTTP communication on port 34567. |
| IPV4 | 91[.]92[.]243[.]79 | IP address listed as part of the malware cluster's C2 infrastructure. |
| SHA256 | 5446b24959c1c2707accfc257aaac61819c01d1ed65bca910a7e8be1787d200f | SHA-256 hash of the analyzed malicious JavaScript sample. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript uses mixed-case repeated-character identifiers and encoded or encrypted content to hinder analysis.T1027.010 · Command ObfuscationPowerShell commands are constructed dynamically and launched with encoded command arguments.T1027.013 · Encrypted/Encoded FilePayloads and stages are transferred AES-encrypted, with decryption parameters supplied through C2.T1041 · Exfiltration Over C2 ChannelCollected host telemetry is sent to the C2 over the same HTTP channel used for commands.T1057 · Process DiscoveryThe implant collects process names through WMI.T1059.001 · PowerShellThe malware launches PowerShell for commands, payload downloads, decryption, and staging.T1059.007 · JavaScriptThe JavaScript implant runs through wscript.exe.T1070.004 · File DeletionThe malware can remove its installed JavaScript copy and temporary or older client files during uninstall or update.T1071.001 · Web ProtocolsThe malware uses HTTP for C2 check-ins, beaconing, tasking, telemetry, and payload delivery.T1082 · System Information DiscoveryThe implant collects host details including domain, username, serial number, OS, memory, model, CPU, and GPU.T1105 · Ingress Tool TransferThe malware downloads encrypted files and additional stages from C2 for execution.T1132.002 · Non-Standard EncodingThe malware uses XOR and reversed-hex encoding for telemetry, strings, and URLs.T1140 · Deobfuscate/Decode Files or InformationThe implant decodes and decrypts strings and payloads using hex, reversed strings, XOR, and AES.T1204.002 · Malicious FileA user executes a JavaScript file disguised as a business document.T1547.001 · Registry Run Keys / Startup FolderThe malware persists by adding itself to the HKCU Run registry key.T1562.001 · Disable or Modify ToolsThe in-memory loader patches AmsiScanBuffer to bypass AMSI scanning.T1571 · Non-Standard PortThe observed C2 endpoint communicates over HTTP port 34567.T1620 · Reflective Code LoadingThe malware reflectively loads a decrypted .NET assembly in memory.
People
Malware
Vendors
Products
PowerShellThe malware’s most reliable detection artifacts are behavioral: unusual wscript.exe activity, PowerShell chains launched from a user directory, suspicious registry writes, and HTTP beaconing to non-standard ports.Windows Script HostDuring analysis of Generic clusters of tracked activity, researchers identified an obfuscated JScript sample executed via Windows Script Host (WSH).
Countries
AustraliaIt has also been observed in Germany, Sweden, Australia, and several other countries.Costa RicaGeographic distribution of victims: primarily the United States, Germany, and Sweden; to a lesser extent Australia, Costa Rica, Greece, Poland, and Turkey.GermanyIt has also been observed in Germany, Sweden, Australia, and several other countries.GreeceGeographic distribution of victims: primarily the United States, Germany, and Sweden; to a lesser extent Australia, Costa Rica, Greece, Poland, and Turkey.PolandGeographic distribution of victims: primarily the United States, Germany, and Sweden; to a lesser extent Australia, Costa Rica, Greece, Poland, and Turkey.SwedenIt has also been observed in Germany, Sweden, Australia, and several other countries.TurkeyGeographic distribution of victims: primarily the United States, Germany, and Sweden; to a lesser extent Australia, Costa Rica, Greece, Poland, and Turkey.United StatesThis threat is currently active and primarily targeting organizations in the United States, with victims confirmed across the technology sector, managed security service providers (MSSPs), telecommunications, and
Industries
Educationacross the technology sector, managed security service providers (MSSPs), telecommunications, and education.Managed Security Service Providersorganizations in the United States, with victims confirmed across the technology sector, managed security service providers (MSSPs), telecommunications, and education.Technologyactive and primarily targeting organizations in the United States, with victims confirmed across the technology sector, managed security service providers (MSSPs), telecommunications, and education.Telecommunicationswith victims confirmed across the technology sector, managed security service providers (MSSPs), telecommunications, and education.