AdWind (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

jar.adwind (Back to overview)

AdWind

aka: AlienSpy, JSocket, Frutas, UNRECOM, JBifrost, Sockrat

URLhaus

Part of Malware-as-service platform
Used as a generic name for Java-based RAT
Functionality
- collect general system and user information
- terminate process
-log keystroke
-take screenshot and access webcam
- steal cache password from local or web forms
- download and execute Malware
- modify registry
- download components
- Denial of Service attacks
- Acquire VPN certificates

Initial infection vector
1. Email to JAR files attached
2. Malspam URL to downlaod the malware

Persistence
- Runkey - HKCU\Software\Microsoft\Windows\current version\run

Hiding
Uses attrib.exe

Notes on Adwind
The malware is not known to be proxy aware

References

2021-11-23 ⋅ HP ⋅ Patrick Schläpfer
RATDispenser: Stealthy JavaScript Loader Dispensing RATs into the Wild
AdWind Ratty STRRAT CloudEyE Formbook Houdini Panda Stealer Remcos

2021-09-03 ⋅ Trend Micro ⋅ Mohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader

2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader

2020-06-28 ⋅ Security-in-Bits ⋅ Security-in-Bits
Interesting tactic by Ratty & Adwind for distribution of JAR appended to signed MSI
AdWind Ratty

2020-04-29 ⋅ Zscaler ⋅ Sudeep Singh
Compromised Wordpress sites used to distribute Adwind RAT
AdWind

2019-05-20 ⋅ Check Point ⋅ Ben Herzog
Malware Against the C Monoculture
AdWind jRAT GhostMiner Zebrocy

2018-09-24 ⋅ Cisco Talos ⋅ Paul Rascagnères, Vitor Ventura, Tomislav Pericin, Robert Perica
Adwind Dodges AV via DDE
AdWind

2018-08-20 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Interesting hidden threat since years ?
AdWind

2018-03-12 ⋅ Github (herrcore) ⋅ Sergei Frankoff
Python decryptor for newer AdWind config file
AdWind

2018-02-16 ⋅ Fortinet ⋅ Xiaopeng Zhang
New jRAT/Adwind Variant Being Spread With Package Delivery Scam
AdWind

2017-10-03 ⋅ Seqrite ⋅ Pavankumar Chaudhari
Evolution of jRAT JAVA Malware
AdWind

2017-07-11 ⋅ Trend Micro ⋅ Rubio Wu, Marshall Chen
Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind
AdWind

2017-07-04 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
MALSPAM WITH JAVA-BASED RAT
AdWind

2015-12-08 ⋅ The Citizenlab ⋅ John Scott-Railton, Morgan Marquis-Boire, Claudio Guarnieri, Marion Marschalek
Packrat: Seven Years of a South American Threat Actor
AdWind Adzok CyberGate Xtreme RAT Packrat

Yara Rules

[TLP:WHITE] jar_adwind_w0 (20170803 | Adwind RAT)

rule jar_adwind_w0 {
    meta:
        author = "Asaf Aprozper, asafa AT minerva-labs.com"
        description = "Adwind RAT"
        reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
        last_modified = "2017-06-25"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/jar.adwind"
        malpedia_version = "20170803"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $a0 = "META-INF/MANIFEST.MF"
        $a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
        $PK = "PK"
    condition:
        $PK at 0 and $a0 and $a1
}

[TLP:WHITE] jar_adwind_w1 (20170803 | Alien Spy Remote Access Trojan)

rule jar_adwind_w1 {
    meta:
        description = "Alien Spy Remote Access Trojan"
        author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
        reference = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
        reference = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
        date = "2015-04-04"
        filetype = "Java"
        hash = "075fa0567d3415fbab3514b8aa64cfcb"
        hash = "818afea3040a887f191ee9d0579ac6ed"
        hash = "973de705f2f01e82c00db92eaa27912c"
        hash = "7f838907f9cc8305544bd0ad4cfd278e"
        hash = "071e12454731161d47a12a8c4b3adfea"
        hash = "a7d50760d49faff3656903c1130fd20b"
        hash = "f399afb901fcdf436a1b2a135da3ee39"
        hash = "3698a3630f80a632c0c7c12e929184fb"
        hash = "fdb674cadfa038ff9d931e376f89f1b6"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/jar.adwind"
        malpedia_version = "20170803"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"
	
        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"
	
        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        $sc_4 = "util"
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"

    condition:
        filesize < 800KB and ((all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)))
}

Download all Yara Rules

AdWind Propose Change

References

Yara Rules

AdWind