New samples of the Adwind RAT have been found that use multi-layer obfuscation. The campaign they are used in has the US petroleum industry as its target, a Netskope research article indicates. Once a system is infected, Adwind gains persistence through the registry. To remain hidden, it injects itself into other processes on the system. Computer security services, such as firewalls and anti-virus applications, are terminated. Sensitive data found on the system is gathered and sent back home. The payload was found on an Australian ISP called Westnet in some of the users’ home directories. Netskope was not certain if the Westnet users’ accounts had been compromised or if the attacker was a Westnet user. Multiple JAR extractions take place when the victim executes the payload. Since the malware is Java-based, it is also cross-platform, i.e., it can function on Windows, Linux, and Mac platforms.
Exposure of sensitive information
Hashes : MD5