EXECUTIVE SUMMARY:
A malicious campaign has been identified that abuses the paste.ee service to deliver remote access trojans like XWorm and AsyncRAT. It began with a seemingly corrupted JavaScript file filled with random Unicode characters. After removing the obfuscation, the script was found to build HTTP requests to download malware from paste.ee. This technique allows attackers to avoid detection by hiding malicious payloads behind a trusted platform. The files are disguised with names like “DOCUMENT FOR DELIVERY INFORMATION.js” to trick users.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A malicious campaign has been identified that abuses the paste.ee service to deliver remote access trojans like XWorm and AsyncRAT. It began with a seemingly corrupted JavaScript file filled with random Unicode characters. After removing the obfuscation, the script was found to build HTTP requests to download malware from paste.ee. This technique allows attackers to avoid detection by hiding malicious payloads behind a trusted platform. The files are disguised with names like “DOCUMENT FOR DELIVERY INFORMATION.js” to trick users.[emaillocker id="1283"]
The JavaScript dropper uses Unicode junk to hide its true behavior. Once cleaned, it forms a URL pointing to paste.ee and uses ActiveX to download and run a payload. Thousands of such paste URLs were identified; many still live and serving Windows PE files. The downloaded executables included XWorm and AsyncRAT, capable of keylogging, screen capturing, and persistent access. AsyncRAT samples used AES-encrypted configs and connected to global C2 servers. These tools give attackers remote control, data theft capabilities, and stealth persistence on infected systems.
This campaign demonstrates how attackers exploit trusted services like paste.ee to evade security tools. The malware delivery method is lightweight, obfuscated, and easily overlooked. The supporting infrastructure spans various global networks, uses unusual ports, and specific SSL certificate patterns. Defenders should watch for unusual traffic to paste.ee, block suspicious URL patterns, and monitor known indicators of compromise linked to XWorm and AsyncRAT activity. This highlights the need for vigilance even when dealing with commonly trusted platforms.
THREAT PROFILE:
THREAT PROFILE:
|
REFERENCES:
The following reports contain further technical details:
[/emaillocker]