Sunday, March 3, 2024

Adwind RAT Malware Attacks on US Petroleum Industry to Steal Sensitive Data

A new malware campaign with the Adwind RAT variant particularly targets the petroleum industry in the US. Adwind, a.k.a Unrecom, Sockrat, JSocket, and jRat is a cross-platform RAT involved in multiple campaigns and it was also distributed via malware-as-a-service in underground markets.

With this campaign threat, actors used a new variant of adware RAT that implements multi-layer obfuscation to try to evade detection.

“We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month,” reads Netskope report.

Adwind RAT Infection

The RAT served as a JAR payload from the domain “members[.]westnet[.]com[.]au/~joeven/”, Westnet is an Australian based ISP. Researchers noted that the same RAT hosted in multiple accounts and to evade detection they the extensions (*.png.jar.jar).

Once the JAR gets dropped in target machine, it creates a copy of itself into the %User% directory and creates registry entry to maintain persistence. Later it executes scripts to disable antivirus and firewall.

Then it creates an AES encryption routine and executes as a new Java thread and it loads the JRAT(Java Runtime Analysis Toolkit) class. JRAT is the open-source performance profiler for the Java platform.

The loaded JRAT class is responsible for downloading the RAT by connecting to the command and control server at 185[.]205[.]210[.]48. The RAT was cross-platform supported, it supports Windows, Linux, and Mac machines.

RAT Functionalities

  • Takes screenshots
  • Harvests credentials from Chrome, IE, and Edge
  • Accesses the webcam, record video and take photos
  • Records audio from the microphone
  • Encrypt and Transfers files
  • Collects general system and user information
  • Steals VPN certificates
  • Serves as a Key Logger

When compared to the previous campaigns the functionality of the RAT remains the same, threat actors made changes in the injection process to evade detection.

Indicators Of Compromise

3bdfd33017806b85949b6faa7d4b98e4
a32c109297ed1ca155598cd295c26611
a9175094b275a0aaed30604f7dceeb14
781fb531354d6f291f1ccab48da6d39f
0b7b52302c8c5df59d960dd97e3abdaf
185[.]205[.]210[.]48
huup://members[.]westnet[.]com[.]au/~philchief/
huup://members[.]westnet[.]com[.]au/~lionsnortham/
huup://members[.]westnet[.]com[.]au/~mcleodart/
huup://members[.]westnet[.]com[.]au/~jbush/
huup://members[.]westnet[.]com[.]au/~joeven/
huup://members[.]westnet[.]com[.]au/~howrahnursery_nbn/

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles