New Multi-stage JS#SMUGGLER Malware Attack Delivers ‘NetSupport RAT’ to Gain Full System Control

A recent malware campaign utilizing multiple stages has been identified, delivering NetSupport RAT via concealed web-based redirects and obfuscated code.

The malware attack comprises three stages, beginning with a JavaScript loader embedded into compromised websites. This loader downloads a stealthy HTA file, executing encrypted PowerShell commands through mshta.exe. In the final stage, a remote access tool is installed, granting attackers full control over affected systems.

Advanced techniques are applied to evade security software detection. Researchers at Securonix have discovered that the campaign uses multiple obfuscation layers, such as numeric index mapping and rotating arrays, to conceal malicious code.

The malware campaign differentiates payloads between mobile and desktop devices. The underlying framework appears to be actively maintained and optimized to remain undetected on infected systems.

The JavaScript loader, upon execution in a victim's browser, establishes rotating arrays of scrambled text and waits for the webpage to fully load. It checks the device type, creating a hidden iframe for mobile devices or loading a remote script for desktops. The browser's local storage is used to track system infections, ensuring the loader runs only once to minimize detection risk.

The loader builds malicious web addresses dynamically and retrieves subsequent attack stages from attacker-controlled domains, including stoneandjon.com and boriver.com.

The second stage involves an HTML Application (HTA) file executed through mshta.exe, commonly misused by attackers. This HTA file, operating covertly, writes an encrypted PowerShell script to the computer's temporary folder. The script employs AES-256-ECB encryption, Base64 encoding, and GZIP compression, masking its true intent.

Decrypted, the payload executes in memory without disk-written files, complicating detection by antivirus software. Temporary files are removed post-execution to conceal the attack.

The final PowerShell payload downloads a ZIP file from kindstki.com, containing NetSupport RAT components, which is then extracted into a folder named CommunicationLayer under ProgramData. This location is chosen to blend with legitimate software.

The malware launches the extracted client32.exe file using a hidden JScript wrapper, disguising the execution chain. To ensure persistent access, it creates a shortcut named WindowsUpdate.lnk in the Startup folder, enabling automatic launch upon user login.

NetSupport RAT facilitates complete remote system access, allowing desktop control, file operations, command execution, data theft, and tunneling. It avoids needing administrator privileges by installing at the user level and using deceptive naming to mimic legitimate Windows components.

Block untrusted scripts. Enable PowerShell logging. Restrict mshta.exe execution. Deploy behavioral detection tools to identify suspicious process chains and fileless execution techniques.

Based on reporting by Cyber Security News.