Hiding in Plain Sight: New Adwind jRAT Variant Uses New Tricks to Mask its Behavior

guest · Oct 29, 2019

New Adwind Variant Targets Windows, Chromium Credentials
October 29, 2019
https://threatpost.com/new-adwind-variant-windows-chromium-credentials/149642/

A new version of the Adwind remote access trojan (RAT) has been discovered taking aim at new targets.

Adwind (a.k.a. JRAT or SockRat) is a Java-based remote access trojan that sniffs out data – mainly login credentials – from victims’ machines. While Adwind has historically been platform-agnostic, researchers say they have discovered a new four-month-old version targeting specifically Windows applications – like Explorer and Outlook – as well as Chromium-based browsers (Chromium is a free and open-source web browser developed by Google), including newer browsers like Brave.
Attack Vector
Once delivered, this new Adwind variant obfuscates the initial JAR file, blocking against any signature-based detection methods.

“Malware that takes advantage of common Java functionality is notoriously difficult to detect or detonate in a sandbox for the simple fact that Java is so common on the web,” researchers with Menlo Security said in a Tuesday post.
Click to expand...

Detection Difficult
Most notably, the Adwind trojan is able to mask its behavior by acting like any other Java command, researchers said.

“Without dynamic construction of the initial JAR file, threat intelligence has very little or no heuristics with which to create a static rule or signature that can effectively detect the initial JAR payload among the millions of Java commands flowing in and out of the corporate network,” said researchers.
Click to expand...

Menlo Security: Hiding in Plain Sight: New Adwind jRAT Variant Uses Normal Java Commands to Mask its Behavior

Log in or Sign up

Hiding in Plain Sight: New Adwind jRAT Variant Uses New Tricks to Mask its Behavior

guest Guest

Log in or Sign up

Hiding in Plain Sight: New Adwind jRAT Variant Uses New Tricks to Mask its Behavior

guest Guest

Useful Searches