Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

njRAT Spreading Through Active Pastebin Command and Control Tunnel

Summary: Unit 42 researchers observed since October 2020 that njRAT (Bladabindi) downloaders fetch second-stage payloads from Pastebin raw URLs, using shortened links to avoid their own command and control infrastructure. The hosted data appeared in several forms - base64, reversed base64, hex-encoded base64, compressed blobs, JSON with a misspelled "downlodLink" key, and plain-text links - with the decoded payloads being 32-bit .NET executables using Windows API functions such as GetKeyboardState() and MapVirtualKey() for keylogging and Trojan behavior.

What you should know: The malware authors are hiding their payloads in plain sight on a legitimate public paste service, and Unit 42 notes the Pastebin C2 tunnel is still alive and being used - so blocking your own C2 infrastructure does nothing when the download comes from a site your users and tools already trust.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related