A new malware campaign with the Adwind RAT variant particularly targets the petroleum industry in the US. Adwind, a.k.a Unrecom, Sockrat, JSocket, and jRat is a cross-platform RAT involved in multiple campaigns and it was also distributed via malware-as-a-service in underground markets.
With this campaign threat, actors used a new variant of adware RAT that implements multi-layer obfuscation to try to evade detection.
“We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month,” reads Netskope report.
Adwind RAT Infection
The RAT served as a JAR payload from the domain “members[.]westnet[.]com[.]au/~joeven/”, Westnet is an Australian based ISP. Researchers noted that the same RAT hosted in multiple accounts and to evade detection they the extensions (*.png.jar.jar).
Once the JAR gets dropped in target machine, it creates a copy of itself into the %User% directory and creates registry entry to maintain persistence. Later it executes scripts to disable antivirus and firewall.
Then it creates an AES encryption routine and executes as a new Java thread and it loads the JRAT(Java Runtime Analysis Toolkit) class. JRAT is the open-source performance profiler for the Java platform.
The loaded JRAT class is responsible for downloading the RAT by connecting to the command and control server at 185[.]205[.]210[.]48. The RAT was cross-platform supported, it supports Windows, Linux, and Mac machines.
- Takes screenshots
- Harvests credentials from Chrome, IE, and Edge
- Accesses the webcam, record video and take photos
- Records audio from the microphone
- Encrypt and Transfers files
- Collects general system and user information
- Steals VPN certificates
- Serves as a Key Logger
When compared to the previous campaigns the functionality of the RAT remains the same, threat actors made changes in the injection process to evade detection.