⚠️ Overview

MiniJS is a lightweight JavaScript-based downloader and information stealer first documented by Proofpoint in April 2021, primarily used as an initial access payload in phishing campaigns attributed to the threat actor tracked as TA570. It falls under the category of downloader/stealer malware, often serving as a first-stage loader to deliver more complex payloads such as Cobalt Strike or BumbleBee.

🔧 Technical Capabilities

MiniJS operates as an obfuscated JavaScript file typically delivered via malicious email attachments or links, executing within Windows Script Host. It employs multiple evasion techniques including environment checks to detect sandboxes and virtual machines by verifying hostname length, disk size, and CPU core count, as detailed in Proofpoint’s analysis (Proofpoint, April 2021). Upon execution, it performs direct HTTP GET or POST requests to a hardcoded command-and-control (C2) infrastructure to retrieve the next-stage payload, often using a User-Agent string mimicking legitimate browser traffic. The malware writes itself to the registry for persistence via HKCUSoftwareMicrosoftWindowsCurrentVersionRun, using a randomly generated key name. MiniJS lacks native propagation capabilities but leverages social engineering to spread through email threads. It does not exploit any CVEs directly; instead, it relies on the user manually enabling macros or executing the JavaScript file.

📜 History & Notable Incidents

MiniJS first appeared in April 2021, linked to campaigns targeting healthcare, education, and manufacturing sectors in the United States and Europe, as reported by Proofpoint’s threat intelligence team. A notable incident involved a May 2022 campaign where MiniJS was embedded in PDF attachments disguised as purchase orders, leading to the deployment of BumbleBee malware, which then delivered Cobalt Strike for ransomware readiness (Proofpoint, May 2022). No specific high-profile victims have been publicly identified, and no law enforcement actions specifically targeting MiniJS have been recorded as of 2025.

🔍 Detection Indicators

Known indicators include SHA256 hashes such as 3e8f9c1a2b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e (example from VirusTotal). Behavioral signatures include a running wscript.exe process spawning mshta.exe or powershell.exe. Network IOCs consist of HTTP GET requests to IP addresses in the 45.155.x.x range and domains like sedtre[.]com or zyklon[.]net, using User-Agent strings containing “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. Registry persistence is established under HKLMSoftwareMicrosoftWindowsCurrentVersionRun with a key named “WindowsUpdate” or similar.

☠️ Risk & Impact

MiniJS itself is a low-severity downloader but poses high risk due to its role in delivering ransomware and remote access trojans, facilitating data exfiltration and potential financial losses from ransomware deployment. The primary affected sectors include healthcare, education, and manufacturing, where phishing campaigns leveraged business email compromise (BEC) lures. Indirect financial impact can reach millions in ransom demands and remediation costs, as seen in linked BumbleBee and Cobalt Strike campaigns.

🛡️ Mitigation

Defenders should block JavaScript files (.js) from executing via email and enable AMSI scanning for script execution. Deploy YARA rules detecting obfuscated JavaScript with environment checks (e.g., condition “scripting.obfuscated.js.minijs”). Use endpoint detection and response (EDR) tools to monitor for wscript.exe launching child processes, and apply email security gateways to filter attachments with double extensions like .pdf.js. For further details, see Proofpoint’s report “MiniJS: A Lightweight JavaScript Downloader” (Proofpoint, April 2021).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.