Netrepser – A JavaScript Targeted Attack
summary
Netrepser is a JavaScript-based targeted framework that infects via malicious Word macros, drops an obfuscated JS payload that registers to C2 and returns an incremental bot ID, and hits an estimated ~500 victims largely in government. Jobs run in-memory JavaScript jobs (eval) and include file-listing, systeminfo collection, credential dumping using near soft recovery tools and browser cookie/password grabs, a customized path_download job that requests specific files, WinRAR-based compression with password u.s. Secret Service, keylogger deployment, persistence, and SDelete-style cleanup.
AI-written summary · about
chapters (11)
- 0:00Introduction to Netrepser
- 1:11Case overview and victims
- 2:38Infection vector and initial payload
- 5:11VB macros and persistence
- 7:51Registration and C2 communication
- 10:18Retrieving attacker commands
- 11:00Job categories and exfiltration
- 16:23Core job and attacker interests
- 20:01Cleanup and kill switch
- 22:16Packer analysis and detection
- 23:54Summary and conclusions
related talks
41m"Revenge of The Script Kiddies: Current Day Uses..."
25mRaiders of the Javascript-based Malware
33mOffensive Javascript Techniques for Red Teamers
55mRevealing the Attack Operations Targeting Japan
49mThe State Of Malware From The Eye Of The Tiger
29mThe Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
42mStart Covering Your Bases And Stop Chasing APT Headlines
54mAnalyzing Emotet infections