s/danrobinsonMALWARE ATTACK•Oct 11
6
votes
388
seen
Fake ChatGrape app delivers Node.js malware behind a normal interface
The fake ChatGrape app runs normally while quietly delivering Node.js malware. The chain starts with a malicious RateConfirmation.vbs file and a ZIP from a suspicious domain, then alters the app’s index.js entry point before launching the legitimate interface. Its code sends a POST request to uniwaysllc.com, indicating apparent command-and-control activity tied to UniWays, which operates across 48 of the 50 U.S. states.
Timeline2
Oct 11
Analysis identified a fake ChatGrape Electron application carrying Node.js malware and apparent UniWays-targeting behavior.
Oct 11
Further discussion referenced MITRE ATT&CK as a framework for analyzing the malware's techniques.
1 comment
Oct 11