Back 
A new campaign spreading the Adwind RAT has been seen in the wild, specifically targeting the petroleum industry in the US. The samples are relatively new and implement multi-layer obfuscation to try to evade detection. We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month. We have previously reported the use of this RAT targeting the retail and hospitality industry.
The overall functionality of the RAT has remained the same as our previous post: It achieves persistence through registry modifications, performs process injection to stay under the radar, terminates security services (e.g., firewall, AV), and steals sensitive data. The major change is in the obfuscation technique, wherein multiple embedded JAR archives are used before unpacking the actual payload. Netskope Threat Protection detects the malware as ByteCode-JAVA.Trojan.Kryptik and Gen:Variant.Application.Agentus.1. This blog post provides an analysis of the new campaign and the new obfuscation techniques.
Responsible Disclosure
The URLs hosting the Adwind RAT were reported to Westnet on September 9th, 2019.
Analysis Details
We discovered the new campaign serving the Adwind RAT JAR payload from “members[.]westnet[.]com[.]au/~joeven/”. Westnet is an Australian ISP. The attacker is either a Westnet user or has compromised the account of one or more Westnet users. The same RAT is being hosted by multiple other Westnet users. Some of the recent uploads have multiple file extensions (*.png.jar.jar) to hide the actual file-type visibility from the target user. We have listed some of the current upload directories in the Indicators of compromise section. At the time of writing, the links were still active.
When the victim executes the payload, there are multiple levels of JAR extractions that occur. Figure 1 below summarizes the execution stages at a high level.
Figure 1: Process execution stages involved in Adwind’s infection chain
Step 1
The dropped JAR payload executes and creates the parent java process and copies itself into the %User% directory. Once the copy is created, the java thread performs the following three actions:
- Executes the copy
- Creates a registry entry in HKCU/CurrentVersion/Run to maintain persistence.
- Creates WMI scripts in %temp% and launches them. These scripts, shown in Figure 2, disable firewall and antivirus service