From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

The modular stealing framework described here is a sophisticated approach to malware development and operation. By using JavaScript modules executed within a Node.js virtual machine (VM) sandbox, the attackers can achieve several key advantages:

1. Dynamic Code Execution: The ability to send new code snippets dynamically allows for rapid updates and adaptation of theft mechanisms without needing to distribute new binaries.
2. Anti-Analysis Techniques: Since the actual stealing logic is not present in the initial binary, static analysis becomes less effective at uncovering the malware's capabilities.
3. Scalability and Flexibility: Different operators can upload and manage their own modules tailored to specific targets or theft methods, making the operation highly flexible and scalable.

Key Components of the Modular Framework

1. Module Execution (ModuleExec)

• The C2 server sends a module_exec command containing JavaScript code as a string.
• This code is executed within a Node.js VM sandbox by module-runner.js.

javascript
 
1// Example module execution in module-runner.js
2const vm = require('vm');
3const script = new vm.Script(moduleCode);
4const context = {};
5script.runInNewContext(context);

2. Module Result (ModuleResult)

Read the full article at Threat Labs - Netskope

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.