A team at HP Wolf named the tool “RATDispenser,” and warned that it currently has a detection rate of only 11%.
“Interestingly, our investigation found that RATDispenser is predominantly being used as a dropper in 94% of samples analyzed, meaning the malware doesn’t communicate over the network to deliver a malicious payload.”
This VBScript file then downloads the malware payload and, if successful, will subsequently delete itself.
The eight malware families include: keylogger and info-stealer Formbook; Java RAT STRRAT, which has remote access, credential stealing and keylogging features; downloader GuLoader; and an open source Java RAT known as Ratty.
According to Schläpfer, the most interesting payload is Panda Stealer.
“First seen in April 2021, this is a new malware family that targets cryptocurrency wallets,” he explained. “The Panda Stealer sample we analyzed were all fileless variants that download additional payloads from a text storage site, paste.ee.”
Panda Stealer and Formbook are always downloaded rather than dropped, but they’re in the minority in terms of the payloads associated with RATDispenser.
“The variety in malware families, many of which can be purchased or downloaded freely from underground marketplaces, and the preference of malware operators to drop their payloads, suggest that the authors of RATDispenser may be operating under a malware-as-a-service business model,” said Schläpfer.