Unveiling the Stealth Tactics: How a JScript Loader Initiates Xworm and Rhadamanthys

Introduction

Cybersecurity experts have recently detected a highly sophisticated, multi-stage attack strategy that employs JScript to deploy significant malware threats.

Understanding the Attack Structure

The complex obfuscation involved in this cyber attack allows for the discreet delivery of either XWorm or Rhadamanthys malware, tailored specifically to the victim’s geographic location.

• The loader initiates with JScript, subtly transitioning into PowerShell.
• It culminates in the distribution of fileless malware, leaving minimal traces.

Initial Attack Vectors

The execution starts either through scheduled tasks or relatively new ClickFix attack methods featuring deceptive CAPTCHAs, targeting users with an mshta.exe command to run obfuscated JScript. This code then crafts PowerShell commands to breach security defenses.

Advanced Geolocation and Payload Delivery

This meticulously designed JScript loader can assemble randomly ordered array elements to create a PowerShell command capable of performing geolocation checks. This confirms if the victim is in the United States, adapting the attack accordingly.

Antiforensic Strategies

Post-execution, the malware deploys several strategies to hide its tracks:

• Termination of competing processes.
• Removal of evidence from system directories.

Following the Trail: Execution Flow Analysis

The malware’s execution process begins with JScript, progressing through a multi-stage deobfuscation and ending with the injection of malicious payloads into legitimate windows processes like RegSvcs.exe. This segment showcases the malware’s complex transition mechanisms, leveraging legitimate system components for malicious purposes.

Geographically Targeted Payloads

Depending on the victim’s location:

• In the US, victims are compromised by XWorm, a Remote Access Trojan.
• Outside the US, Rhadamanthys, an advanced info-stealer, is deployed.

Professional Recommendations

It’s crucial for security teams to enhance detection systems to spot suspicious PowerShell activities and prevent fileless malware injections.

Explore Defensive Strategies

Equip your security operations with cutting-edge solutions to proactively engage and mitigate these sophisticated threats.

Source & Further Reading

Detailed Article on JScript Loader Attack

Related: 5 Reasons Why You Shouldn’t Delete the inetpub Folder on Windows 11

Last Updated: April 15, 2025