Rewterz Threat Alert – Adwind Campaign targeting Petroleum Sector

Severity

High

Analysis Summary

New samples of the Adwind RAT have been found that use multi-layer obfuscation. The campaign they are used in has the US petroleum industry as its target, a Netskope research article indicates. Once a system is infected, Adwind gains persistence through the registry. To remain hidden, it injects itself into other processes on the system. Computer security services, such as firewalls and anti-virus applications, are terminated. Sensitive data found on the system is gathered and sent back home. The payload was found on an Australian ISP called Westnet in some of the users’ home directories. Netskope was not certain if the Westnet users’ accounts had been compromised or if the attacker was a Westnet user. Multiple JAR extractions take place when the victim executes the payload. Since the malware is Java-based, it is also cross-platform, i.e., it can function on Windows, Linux, and Mac platforms.

Impact

Exposure of sensitive information

Indicators of Compromise

IP

185[.]205[.]210[.]48

Hashes : MD5

• 0b7b52302c8c5df59d960dd97e3abdaf
• 3bdfd33017806b85949b6faa7d4b98e4
• 781fb531354d6f291f1ccab48da6d39f
• a32c109297ed1ca155598cd295c26611
• a9175094b275a0aaed30604f7dceeb14

URL

• http[:]//members[.]westnet[.]com[.]au/~howrahnursery_nbn/
• http[:]//members[.]westnet[.]com[.]au/~jbush/
• http[:]//members[.]westnet[.]com[.]au/~joeven/
• http[:]//members[.]westnet[.]com[.]au/~lionsnortham/
• http[:]//members[.]westnet[.]com[.]au/~mcleodart/
• http[:]//members[.]westnet[.]com[.]au/~philchief/

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.