Two malicious spam campaigns delivering Java RAT

guest · Jan 26, 2019

Two malicious spam campaigns delivering Java RAT
The Story of Manuel’s Java RAT
January 25, 2019
https://blog.yoroi.company/research/the-story-of-manuels-java-rat/

During the last weeks, the Cybaze-Yoroi ZLab researchers identified infection attempts aimed to install RAT malware directed to the naval industry sector. The malicious email messages contained a particular Adwind/JRat variant delivered via several methods tailored to lure the target company.

[...] in this case, Cybaze-Yoroi ZLab detected the usage of multiplatform Java malware.
[...] a malware routine checks the existence of the Java environment on the victim machine: if it is not installed it downloads the JRE environment from an external location [...]

The usage of the VPN service hides the real location of the attacker, however, the specific IP isn’t new to the threat intel community, it has been abused since october 2018.
Conclusions
The analyzed case shows how threat actors may quickly vary attack techniques and artifact characteristics, trying to masquerade their intent by making harder to track their attempts.
Click to expand...

guest · Mar 5, 2019

JAVA-VBS Joint Exercise Delivers RAT
March 1, 2019
https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/java-vbs-joint-exercise-delivers-rat/

The Adwind remote administration tool (RAT) is a Java-based backdoor Trojan that targets various platforms supporting Java files.
Infection chain:
The malware’s spreading mechanism is the same as in previous versions. It arrives in a spam email with a .jar attachment. The contents of the email are carefully crafted to lure victims using social engineering techniques.
The parent JAR file:
Generally, Adwind comes in an obfuscated form to hide its malicious intent.
After Adwind successfully infects a system, we have seen it log keystrokes, modify and delete files, download and execute further malware, take screenshots, access the system’s camera, take control of the mouse and keyboard, update itself, and more.

In past, we have seen threat actors using two similar functioning malware families in a single infection. Usually, threat actors chose this path for higher probability of successful infection.
Click to expand...

Log in or Sign up

Two malicious spam campaigns delivering Java RAT

guest Guest

guest Guest

Log in or Sign up

Two malicious spam campaigns delivering Java RAT

guest Guest

guest Guest

Useful Searches