A new malware campaign with the Adwind RAT variant particularly targets the petroleum industry in the US. Adwind, a.k.a Unrecom, Sockrat, JSocket, and jRat is a cross-platform RAT involved in multiple campaigns and it was also distributed via malware-as-a-service in underground markets.

With this campaign threat, actors used a new variant of adware RAT that implements multi-layer obfuscation to try to evade detection.

“We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month,” reads Netskope report.

Adwind RAT Infection

The RAT served as a JAR payload from the domain “members[.]westnet[.]com[.]au/~joeven/”, Westnet is an Australian based ISP. Researchers noted that the same RAT hosted in multiple accounts and to evade detection they the extensions (*.png.jar.jar).

Once the JAR gets dropped in target machine, it creates a copy of itself into the %User% directory and creates registry entry to maintain persistence. Later it executes scripts to disable antivirus and firewall.

Then it creates an AES encryption routine and executes as a new Java thread and it loads the JRAT(Java Runtime Analysis Toolkit) class. JRAT is the open-source performance profiler for the Java platform.

The loaded JRAT class is responsible for downloading the RAT by connecting to the command and control server at 185[.]205[.]210[.]48. The RAT was cross-platform supported, it supports Windows, Linux, and Mac machines.

RAT Functionalities

• Takes screenshots
• Harvests credentials from Chrome, IE, and Edge
• Accesses the webcam, record video and take photos
• Records audio from the microphone
• Encrypt and Transfers files
• Collects general system and user information
• Steals VPN certificates
• Serves as a Key Logger

When compared to the previous campaigns the functionality of the RAT remains the same, threat actors made changes in the injection process to evade detection.

Indicators Of Compromise

3bdfd33017806b85949b6faa7d4b98e4

a32c109297ed1ca155598cd295c26611

a9175094b275a0aaed30604f7dceeb14

781fb531354d6f291f1ccab48da6d39f

0b7b52302c8c5df59d960dd97e3abdaf

185[.]205[.]210[.]48

huup://members[.]westnet[.]com[.]au/~philchief/    

huup://members[.]westnet[.]com[.]au/~lionsnortham/ 

huup://members[.]westnet[.]com[.]au/~mcleodart/    

huup://members[.]westnet[.]com[.]au/~jbush/

huup://members[.]westnet[.]com[.]au/~joeven/

huup://members[.]westnet[.]com[.]au/~howrahnursery_nbn/    

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates