Spam Campaign Distributes AdWind RAT

Dell SecureWorks Counter Threat Unit™ (CTU) researchers analyzed spam campaigns that distributed the AdWind remote access trojan (RAT). AdWind, also known as Frutas, UNRECOM, AlienSpy, and JSocket, is a Java-based RAT.

It is typically distributed as a .jar (Java archive) attachment via spam emails (see Figure 1) and relies on social engineering to convince a victim to execute the attachment. In some samples analyzed by CTU researchers, the attachment was an obfuscated VBScript (.vbs) file that downloads and installs AdWind, or the email message just included a link to download and install the malware.

Figure 1. Example spam email distributing AdWind. (Source: Dell SecureWorks)

The Java Runtime Environment (JRE) must be installed for the malware to execute. Some AdWind variants download and install the required version of JRE if it is not installed on the victim's system. Because the malware is written in Java, it can run on multiple operating systems such as Windows, Mac OSX, and Linux.

The AdWind RAT .jar file is obfuscated, and its payload and configuration file (which serves as an installation file) are encrypted with the DES, RC4, or RC6 ciphers. The malware attempts to decrypt itself during execution. Once executed, AdWind has the following capabilities:

• Log keystrokes
• Access webcam
• Take screenshots
• Remotely access the file system (read, write, delete)
• Remotely access the mouse and keyboard
• Download and execute other files from a remote server

CTU researchers observed AdWind creating and operating from a directory structure under the victim's home directory that uses random alphanumeric characters for the directory name and filename, and includes a random file extension for the file (e.g., C:\Users\<user>\NbZNzkmlJBe\CSBIZZZtmAS.aeYHig). It may also drop a text file such as C:\Users\<user>\NbZNzkmlJBe\ID.txt.

The malware changes the folder and file attributes to system, hidden, and read-only using the attrib command:

attrib +s +h +r "C:\Users\<user>\NbZNzkmlJBe\*.*"

attrib +s +h +r "C:\Users\<user>\NbZNzkmlJBe"

AdWind copies the related Java Runtime files to a temporary directory within the victim's home directory using the xcopy command:

xcopy "C:\Program Files\Java\jre7" "C:\Users\<user>\AppData\Roaming\Oracle\" /e

It then adds its file path to the HKCU Run registry key for persistence using the reg command:

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run

/v RgnxMoHuBRi /t REG_EXPAND_SZ /d 

"\"C:\Users\<user>\AppData\Roaming\Oracle\bin\javaw.exe\"

 -jar \"C:\Users\<user>\NbZNzkmlJBe\CSBIZZZtmAS.aeYHig\"" /f

The command generates the following registry entry:

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RgnxMoHuBRi

Data: "C:\Users\<user>\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\<user>\NbZNzkmlJBe\CSBIZZZtmAS.aeYHig"

The AdWind RAT is then launched using javaw.exe so that there is no associated console window:

C:\Users\<user>\AppData\Roaming\Oracle\bin\javaw.exe -jar

C:\Users\<user>\NbZNzkmlJBe\CSBIZZZtmAS.aeYHig

AdWind communicates with its command and control (C2) server over SSL on non-standard ports with self-signed certificates. It can also be built with a kit and can be configured to access any URL.

Figure 2 shows an example AdWind RAT .jar file when viewed with a Java Decompiler application. The decrypted data file in this path structure reveals the configuration information:

"WvB/JYXJPW/hSSimiMZ/SNUn/lsJ/eXCa/

LfKgRy4ws/PbMPKS/GyVeo/YNut/kYSS/XzhhPjlv/mBuvWlLy/cbCRMY/mTHOtTX/CzU/MVPV.YWiHD"

Figure 2. AdWind RAT .jar file viewed with a Java Decompiler application. (Source: Dell SecureWorks)

Figure 3 shows other examples.

Figure 3. Other AdWind RAT .jar examples viewed with a Java Decompiler application. (Source: Dell SecureWorks)

The config.xml configuration file shown in Figure 3 is encrypted. When decrypted, the file reveals the folder name that will be created under the victim's home directory (Install Folder), the filename for the copy of AdWind RAT in that directory (Jar Name), the registry information to add to the HKCU Run key (Reg Key and Reg Value), the server that will be contacted (Domain), and the port numbers to communicate with the remote attacker (Port1 and Port2):

Campaign ID : 1312201510
Domain : edebiyazarlar.com
Install Flag : true
Install Folder : Rii
Jar Name : Toj
Password : 2917d242147c5461835d961c57b1dfc29f5c18a3
Port1 : 1991
Port2 : 1992
Reg Key : 6P1zMW4coqEf7XbrzY2awZ3R
Reg Value : Gyw
Version : Adwind RAT v1.0

In the spam samples that include obfuscated .vbs attachments, the attachment downloads and installs AdWind if allowed to execute on a Windows system. Figure 4 shows a sanitized version of one of these scripts. The "VCMzGlxzahzsKs" variable (highlighted in green) is used to build the new deobfuscated VBScript code, which is then stored in the "KcpDUogbNYDXMyAdePwN" variable and executed using the EXECUTE command. The deobfuscated code can be obtained by commenting out the EXECUTE command and substituting it with the Wscript.StdOut.Write function (shown in the red box), and then executing the obfuscated .vbs script at the command prompt using the cscript command.

Figure 4. Obfuscated .vbs script that downloads AdWind RAT. (Source: Dell SecureWorks)

Figure 5 shows a segment of the deobfuscated .vbs script. The code has been commented by the attacker. If a check reveals that JRE is not installed on the system, the script attempts to download a version of JRE based on the operating system architecture (32-bit or 64-bit). The download URLs for the JRE are highlighted in the red box. The avppet . com domain resolves to IP address 173 . 254 . 37 . 144.

Figure 5. Deobfuscated .vbs script that downloads the AdWind RAT. (Source: Dell SecureWorks)

The script then downloads and executes the Adwind RAT .jar file (PO2016_PDF.jar) from http: //ge . tt/api/1/files/5jevrdW2/0/blob?download. The ge . tt domain is hosted on Amazon Web Services IP address space and may also be connected to s3 . kkloud . com . s3 . amazonaws . com.

To mitigate exposure to these threats, CTU researchers recommend that organizations use available controls to restrict access using the indicators in Table 1. The URLs, domains, and IP addresses may contain malicious content, so consider the risks before opening them in a browser.

Table 1. Indicators for this threat.