A new report from HP’s Threat Research Blog provides details of an evasive Javascript loader that gets passed security tools 89% of the time.

Remote Access Trojans (RATs) are a class of malware that is designed to gain persistent access to the target computer system, and by leveraging elevation of privilege vulnerabilities gain administrator rights over the device and so take full control of the system and all the data on it.

RATDispenser is the name given to a JavaScript delivery system for RAT malware used by at least eight different families of malware.  RATDispenser is usually used as a self contained dropper – it does not need to communicate over the network back to any command and control servers as it already contains the malicious payload it wants to deliver.

This may sound sophisticated, but the delivery system is actually relatively simple and Security Managers can take some basic steps to harden their network against RATDispenser and similar malware.

The attack chain begins with the delivery of an email that has the malware enclosed as an attachment which uses a double file extension to allow the JavaScript file to masquerade as a text file – for example OPENME.txt.js  When the user double clicks the attachment to open the text file, the javascript will execute on Windows computers with default protections in place.

When the Javascript executes, it writes a VBSript file into a temp folder and then executes the script with a long, chained argument, which is the main payload that the VBScript writes to disk and executes.

Defend against RATDispenser

Security Managers can defend against RATDispenser and similar malware in two ways:

• Block executable email attachments
• Limit the running of scripts to require digitally signed scripts or block them all together.

Blocking executable email attachments can be done by following this guidance for Microsoft Exchange. Firewalls and security appliances may also have the ability to inspect incoming email and filter out malicious attachments.

If a malicious attachment does manage to get delivered to an end user, and despite their Security Awareness Training they still click on the attachment to open it, then disabling or limiting the execution of scripts will provide an additional layer of defence.

Windows Script Host can be fully disabled by adding a registry entry.  However, there may be legitimate use of Windows Scripting for system administration in which case it is possible to configure a Windows system to only allow digitally signed scripts to execute.

Note that if you have not configured Software Restriction Policies for your domain, you will first need to disable them by setting the registry for  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\useWINSAFER to 0 and then you can set TrustPolicy to 2 (2 = only allow signed scripts or set it to 1 to always ask before running a script if it is not signed).