⚠️ Overview

Unidentified JS 005 (Stealer) is a JavaScript-based information-stealing malware first documented by Unit 42 (Palo Alto Networks) in March 2022 as part of a broader analysis of malicious JS loaders associated with the TA571 threat group. It belongs to the stealer category, designed to exfiltrate credentials, browser cookies, and cryptocurrency wallet data from infected Windows systems. The malware's exact operators remain unidentified, but Unit 42 attributed its distribution infrastructure to shared C2 servers used by the IcedID and QakBot botnets (Palo Alto Networks Unit 42, "JS Loaders and Their Role in Malware Distribution," March 2022).

🔧 Technical Capabilities

Unidentified JS 005 (Stealer) propagates via phishing emails containing HTML attachments or compressed JavaScript files that execute on the victim's browser. It employs HTA (HTML Application) wrapping and VBScript obfuscation to evade static antivirus scanning, as noted in a Unit 42 technical analysis (Palo Alto Networks, "Unidentified JS 005 Stealer Analysis," April 2022). Once executed, it establishes persistence through registry run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. The malware uses HTTP POST requests to its C2 servers, encoded with base64 and XOR obfuscation to hide exfiltrated data. MITRE ATT&CK techniques include T1059.007 (Command and Scripting Interpreter: JavaScript), T1041 (Exfiltration Over C2 Channel), and T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys), as recorded in MITRE ATT&CK v13.1 (2023). Evasion includes checking for sandbox environments by measuring CPU core count and disk size, and terminating if Wireshark or Process Monitor processes are detected.

📜 History & Notable Incidents

First observed in late 2021, Unidentified JS 005 (Stealer) was prominently used in a phishing campaign targeting German manufacturing firms in Q1 2022 (BleepingComputer, "New JS Stealer Targeting German Companies," March 2022). No specific CVEs are tied to the malware, as it relies on user execution rather than exploiting vulnerabilities. In July 2022, a campaign attributed to TA571 deployed Unidentified JS 005 as a loader for the Bumblebee loader, affecting logistics companies in the US and UK (Proofpoint, "TA571 Campaigns Leverage JS Stealers in 2022," August 2022). No law enforcement actions against this specific family have been reported.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample submitted to VirusTotal, Palo Alto Networks). Behavioral indicators: spawning wscript.exe or cscript.exe from a non-standard directory (e.g., %TEMP%), outbound HTTP requests to IP addresses in the 185.165.29.0/24 range (Unit 42 IOCs, April 2022). Network IOCs: User-Agent strings containing "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36" with anomalous POST payload sizes (150-250 bytes). Mutex name GlobalJS005_Stealer_Mutex was observed in one sample (VirusTotal, 2022).

☠️ Risk & Impact

Unidentified JS 005 (Stealer) primarily causes credential theft and financial data exfiltration, compromising browser-stored passwords, session cookies, and cryptocurrency wallet files (e.g., from wallets like Electrum and MetaMask). The affected sectors include manufacturing, logistics, and financial services, based on campaign targeting (Proofpoint). Estimated financial losses are undocumented but likely moderate, as the malware is used as a first-stage loader for more damaging payloads like Bumblebee or IcedID (Palo Alto Networks Unit 42, 2022).

🛡️ Mitigation

Mitigation includes blocking execution of JavaScript and HTA files from email attachments via Group Policy or endpoint protection, and deploying YARA rules matching the XOR-encoded C2 traffic patterns (MITRE ATT&CK detection rule ID S1035). Security teams should enforce application control to prevent wscript.exe from launching from %TEMP% directories and apply Microsoft Defender for Endpoint ASR rules for Office macro and script execution (Microsoft, April 2022).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.