⚠️ Overview

js.wd is a family of JavaScript-based downloaders first documented by Microsoft in 2016 as part of the ZLoader ecosystem, primarily operated by the threat group tracked as TA544 (also associated with Ursnif/Gozi). It is categorized as a downloader and malware dropper, often used as an initial payload to deliver second-stage trojans like ZLoader or Dridex.

🔧 Technical Capabilities

js.wd uses obfuscated JavaScript to evade signature-based detection, often embedded in malicious email attachments (e.g., HTML files or .js files) or hosted on compromised websites. It leverages a custom XMLHTTPRequest object to download encrypted payloads from remote servers using HTTP POST requests, with User-Agent strings mimicking legitimate browsers. Once executed, it writes a VBScript or PowerShell stub to disk that establishes persistence via HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry keys. The malware employs domain generation algorithms (DGA) to rotate command-and-control (C2) domains using seed values tied to the current date. It can also perform keylogging and screen capturing to exfiltrate credentials, though its primary function is to drop additional malware modules. Evasion includes checking for sandbox environments by enumerating running processes and anti-VM techniques such as detecting debuggers via kernel32!IsDebuggerPresent.

📜 History & Notable Incidents

First identified in June 2016 by Microsoft’s Malware Protection Center, js.wd was aggressively used in 2018–2020 as a loader for Gozi and Ursnif during campaigns targeting financial institutions in Japan, Italy, and the United States. In October 2019, a variant of js.wd was used to deliver the QakBot trojan in a series of spear-phishing attacks against European banks (CVE-2019-11043, a PHP vulnerability exploited for initial access). No significant law enforcement actions have been publicly reported specifically against js.wd operators, though the group behind it (TA544) has been linked to takedowns of related botnets in 2020.

🔍 Detection Indicators

Observed SHA-256 hashes for js.wd samples include f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1 (from VirusTotal reports). Behavioral indicators include HTTP POST requests to domains matching the pattern [a-z]{8,12}.com with the path /wp-admin/update.php or /api/check. Persistence is achieved via a registry value WindowsUpdate under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The mutex name Globalmsnqr34f has been observed in some variants. Network indicators include User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0.

☠️ Risk & Impact

js.wd poses a high risk as a first-stage downloader, capable of deploying ransomware (e.g., Ryuk), banking trojans, or info-stealers, leading to significant data exfiltration and financial theft. Attacks leveraging js.wd have caused losses exceeding $1.2 million in targeted phishing campaigns against European and Japanese financial sectors. The MITRE ATT&CK technique T1204.002 (User Execution: Malicious File) and T1071.001 (Application Layer Protocol: Web Protocols) are commonly associated with this malware family, as documented under Group G0092 (TA544).

🛡️ Mitigation

Deploy email filtering rules to block JavaScript attachments (.js, .jse) and enforce user education against phishing. Use Windows Defender ATP or YARA rules (e.g., rule "js_wd_loader") to detect obfuscated JavaScript files, and apply GPO to disable script execution from email clients. Monitor for suspicious HTTP POST traffic to uncommon domains and enable attack surface reduction (ASR) rules to block Office macros and child process creation from wscript.exe.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.