{"id":1975,"date":"2024-09-25T09:57:03","date_gmt":"2024-09-25T09:57:03","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1975"},"modified":"2025-07-29T03:09:48","modified_gmt":"2025-07-29T03:09:48","slug":"analysis-of-jar-adwind-campaign","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/analysis-of-jar-adwind-campaign\/","title":{"rendered":"Analysis of JAR Adwind Campaign"},"content":{"rendered":"\n

Adwind RAT (Remote Access Trojan) is a cross-platform, multifunctional remote access program which is distributed through a single malware-as-a-service platform. One of the main features that distinguish the Adwind RAT from other commercial malware is its distribution openly in the form of a paid service, where the \u201ccustomer\u201d pays a fee for using the malicious program. The aliases for Adwind RAT include: Adwind, Alien Spy, JConnectPro, JBifrost, JSocket, UnknownRat & UnReCoM.<\/p>\n\n\n\n

 <\/p>\n\n\n\n

Static Analysis<\/strong><\/h3>\n\n\n\n

Language Used: Java \/ JDK 1.6x\/1.7x \/ Swing<\/strong><\/p>\n\n\n\n

Code base: Frutas Rat (2012-2013)<\/strong><\/p>\n\n\n\n

Target OS: Windows, Linux, Mac OS, Android<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

After 2012, throughout the subsequent rebranding, Adwind maintained control, and the aliases were sold separately, as products although they all share the same code base, that of jFrutas \/ Frutas RAT. This particular RAT played a significant role in attack campaigns against banks, and one of its variants was implicated in Alberto Nisman’s murder.<\/p>\n\n\n\n

 <\/p>\n\n\n\n

Anti-VMWare\/Virtual Box Code<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Although malware can be camouflaged in a variety of ways, testing for the presence of virtual environments reduces the possibility that it will get executed and thereby get detected. Adwind has a good illustration of this evasive behavior using byte code, before engaging in any malicious activity, Adwind code checks the system to see if it is running in a Virtual Box or VMware virtual machine.<\/p>\n\n\n\n

 <\/p>\n\n\n\n

Code hints at a Spanish author<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Class names, variables, function names declared and used in Java are from Spanish language, Example; Archivo, conectado, herramientas, nombre etcetra.<\/p>\n\n\n\n

Translation: Nombre \u2013 Number, Archivo \u2013 Archive, Herramientas – Tools<\/p>\n\n\n\n

 <\/p>\n\n\n\n

Dynamic Analysis<\/strong><\/h3>\n\n\n\n

Infection Chain<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Adwind RAT infects the victim\u2019s machine by initial infection vectors of spam campaign with attachment (EML), and a suspicious URL to download the malware. The attachment is a MS Word document (.DOCX). The threat actor can trick the user to click on the blurred image to view the document\u2019s content. Once the user opens the .img content, using embedded doc to drop the .JAR file in the %temp% folder to start infecting and perform threat actor\u2019s action on objective.<\/p>\n\n\n\n

Sample Information<\/strong><\/p>\n\n\n\n

SHA256: 978ef2598a67ed3fd18cf7f79a716fa34750f69057626826cab906d3114faa17<\/strong><\/p>\n\n\n\n

Category: Remote Access Tool \/ Spyware<\/strong><\/p>\n\n\n\n

Threat Name: Adwind RAT<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Technical Analysis of DOCX<\/strong><\/p>\n\n\n\n

Snap 1: Attachment document of [.docx]<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once the user opens the attachment file, we can see there\u2019s a blurred image, resembles some MS Excel work. What do we usually get? Click the enable content\/enable editing to view the actual content of the image. Now, the document displays a blurred image embedded in the .JAR file.<\/p>\n\n\n\n

Snap 2: Generation of .JAR file<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once the user clicks on the blurred image, then a pop-up will be generated, it loads the JAR file and requests the user\u2019s permission to open. If you run the malware manually, it will infect your system and even crash it when permissible.<\/p>\n\n\n\n

Snap 3: .JAR properties<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

JAR files are .zip files that contain a compressed version of .class files, audio files, image files, or directories. The main advantage of JAR files such as lossless data compression, archiving, decompression, and archive unpacking. Not to mention, JAR files (Java code) can be run on any platform, code once and infect multiple operating systems.<\/p>\n\n\n\n

Snap 4: Structure of MS Word [DOCX] document<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

DOCX files store data in Open XML Document format, which was introduced by Microsoft from MS Word 2007. It replaced the .DOC file format as the standard format for saving documents in MS Word. Unlike DOC files, which store document data in a single binary file, DOCX files save data as separate files and folders in a compressed ZIP package. Within a DOCX file are XML files and three folders:  Word, docProps, and _rels,<\/strong> which store the content, document properties, and relationships between the files. The Open XML format is designed to make document content more open and accessible.<\/p>\n\n\n\n

For example, document text is saved in plain text files, and document images are stored as individual image files, such as .JPG or .PNG, within the DOCX file. The included files may also contain page formatting information, authorship data, and document review notes.<\/p>\n\n\n\n

 <\/strong><\/p>\n\n\n\n

Snap 5: Embedded DOC file<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

DOC files are created to save various documents, including letters, resumes, essays, and invitations. When we create a document in MS Word, we can then choose to save it in either the DOC, or DOCX file format. Adwind JAR then creates a DOC file to store the document’s contents, which can be closed and opened again for further editing. When you are done editing your DOC file you can print it or save it as another file, such as .PDF document or .DOT (template) document.<\/p>\n\n\n\n

Snap 6: Embedded OLE_native files<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 <\/strong><\/p>\n\n\n\n

Snap 7: Dropped .JAR in %temp%<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After the completion of step 2 once the user accepts & opens the document content. Then, the .JAR file will be dropped in the %temp% folder.<\/p>\n\n\n\n


Snap 8: Structure of .JAR file<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

JAR file is a Java archive (JAR) file used by the Java Runtime Environment (JRE), a framework used for executing Java programs. JAR files may serve as program libraries or as standalone programs that run if the JRE is installed on the computer or mobile device. After 2015-2016, a lot of the cracked versions of Adwind malware being circulated are used by hundreds of threat actors, which means that there are multiple hundreds of command-and-control servers. Some of them are down, some are up, the others are turned on as required by the threat actors.<\/p>\n\n\n\n

 <\/p>\n\n\n\n

Once infected, the following process\/functions are carried out by Adwind RAT,<\/strong><\/p>\n\n\n\n

    \n
  • Collecting information about the compromised host.<\/li>\n\n\n\n
  • Creating scheduled tasks (privilege escalation and persistence).<\/li>\n\n\n\n
  • Credentials harvesting.<\/li>\n\n\n\n
  • Taking screenshots, pictures, and recording video & sound from a microphone\/webcam.<\/li>\n\n\n\n
  • Credential dumping (.exe access).<\/li>\n\n\n\n
  • Password stealing (from browser history and cookies).<\/li>\n\n\n\n
  • Steal VPN certificates.<\/li>\n\n\n\n
  • Targeting web banking links (web injects).<\/li>\n\n\n\n
  • Stealing keys of cryptocurrency wallets.<\/li>\n\n\n\n
  • Password brute forcing.<\/li>\n\n\n\n
  • Process injection to conceal the malicious actions.<\/li>\n<\/ul>\n\n\n\n

     <\/p>\n\n\n\n

    MITRE ATT&CK Mapping for jRAT \/ Adwind RAT<\/strong><\/h3>\n\n\n\n
    ID<\/strong><\/td>Technique<\/strong><\/td>Functionality<\/strong><\/td><\/tr><\/thead>
    T1123<\/td>Audio Capture<\/td>jRAT can capture microphone recordings.<\/td><\/tr>
    T1037<\/td>Boot or Logon Initialization Scripts: Startup Items<\/td>jRAT can list and manage startup entries.<\/td><\/tr>
    T1115<\/td>Clipboard Data<\/td>jRAT can capture clipboard data.<\/td><\/tr>
    T1059<\/td>Command and Scripting Interpreter: Windows Command Shell<\/td>jRAT has command line access.<\/td><\/tr>
     <\/td>Command and Scripting Interpreter: Visual Basic<\/td>jRAT has been distributed as HTA files with VBScript.<\/td><\/tr>
     <\/td>Command and Scripting Interpreter: JavaScript<\/td>jRAT has been distributed as HTA files with JScript.<\/td><\/tr>
    T1555<\/td>Credentials from Password Stores: Credentials from Web Browsers<\/td>jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.<\/td><\/tr>
    T1083<\/td>File and Directory Discovery<\/td>jRAT can browse file systems.<\/td><\/tr>
    T1070<\/td>Indicator Removal: File Deletion<\/td>jRAT has a function to delete files from the victim\u2019s machine.<\/td><\/tr>
    T1105<\/td>Ingress Tool Transfer<\/td>jRAT can download and execute files.<\/td><\/tr>
    T1056<\/td>Input Capture: Keylogging<\/td>jRAT has the capability to log keystrokes from the victim\u2019s machine, both offline and online.<\/td><\/tr>
    T1027<\/td>Obfuscated Files or Information<\/td>jRAT\u2019s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.<\/td><\/tr>
     <\/td>Software Packing<\/td>jRAT payloads have been packed.<\/td><\/tr>
    T1120<\/td>Peripheral Device Discovery<\/td>jRAT can map UPnP ports.<\/td><\/tr>
    T1057<\/td>Process Discovery<\/td>jRAT can query and kill system processes.<\/td><\/tr>
    T1090<\/td>Proxy<\/td>jRAT can serve as a SOCKS proxy server.<\/td><\/tr>
    T1021<\/td>Remote Services: Remote Desktop Protocol<\/td>jRAT can support RDP control.<\/td><\/tr>
    T1029<\/td>Scheduled Transfer<\/td>jRAT can be configured to reconnect at certain intervals.<\/td><\/tr>
    T1113<\/td>Screen Capture<\/td>jRAT has the capability to take screenshots of the victim\u2019s machine.<\/td><\/tr>
    T1518<\/td>Software Discovery: Security Software Discovery<\/td>jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim\u2019s machine and to obtain firewall details.<\/td><\/tr>
    T1082<\/td>System Information Discovery<\/td>jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.<\/td><\/tr>
    T1016<\/td>System Network Configuration Discovery<\/td>jRAT can gather victim internal and external IPs.<\/td><\/tr>
    T1049<\/td>System Network Connections Discovery<\/td>jRAT can list network connections.<\/td><\/tr>
    T1007<\/td>System Service Discovery<\/td>jRAT can list local services.<\/td><\/tr>
    T1552<\/td>Unsecured Credentials: Credentials In Files<\/td>jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.<\/td><\/tr>
     <\/td>Unsecured Credentials: Private Keys<\/td>jRAT can steal keys for VPNs and cryptocurrency wallets.<\/td><\/tr>
    T1125<\/td>Video Capture<\/td>jRAT has the capability to capture video from a webcam.<\/td><\/tr>
    T1047<\/td>Windows Management Instrumentation<\/td>jRAT uses WMIC to identify anti-virus products installed on the victim\u2019s machine and to obtain firewall details.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

     <\/p>\n\n\n\n

    Indicator of Compromise<\/strong><\/h3>\n\n\n\n

    Hashes<\/strong><\/p>\n\n\n\n

    7e4bdf62d3ecd78b3f407f6ec1158678<\/p>\n\n\n\n

    0a5f34440389ca860235434eea963465<\/p>\n\n\n\n

    1da18ec639f7ec2a8aad58655d846e23<\/p>\n\n\n\n

    d7489b47e17630e5594a320b43b201db<\/p>\n\n\n\n

    da52c24302a03626d2175123b751f466<\/p>\n\n\n\n

    b766cf6695730b74a107cb73157262b1<\/p>\n\n\n\n

    919f2d0043f063a90702fb36887699e8<\/p>\n\n\n\n

    d470d5a428f99818278fb2816a8d03e9<\/p>\n\n\n\n

    8f5e55fbb1bee93dc5912dcbd0092519<\/p>\n\n\n\n

    4a97b2d004d72b69aa64f621b5b74775<\/p>\n\n\n\n

    051b4da1f0079c6f60d6c8eb62b3f586<\/p>\n\n\n\n

    2020551b5373121053abdbf3eaafa02d<\/p>\n\n\n\n

    a4da22e269b93148eb9857036b9a072a<\/p>\n\n\n\n

    876eb4208ef2eec6e9f12b13f764a975<\/p>\n\n\n\n

    1d77e96974e1e2301ed78cec19e8710b<\/p>\n\n\n\n

    IP Address \/ Domains<\/strong><\/p>\n\n\n\n

    212[.]114[.]52[.]236:9932<\/p>\n\n\n\n

    unks123[.]duckdns[.]org:46865<\/p>\n\n\n\n

    lay[.]dubya[.]us:8181<\/p>\n\n\n\n

    fresh[.]ygto[.]com:1010<\/p>\n\n\n\n

    gwiza1988[.]hopto[.]org:6025<\/p>\n\n\n\n

    praisesalways[.]ddns[.]net:1010<\/p>\n\n\n\n

    wawa[.]cleansite[.]us:1010<\/p>\n\n\n\n

    dlee889.mywire[.]org:5858<\/p>\n\n\n\n

    URLs Hosting the JAR files<\/strong><\/p>\n\n\n\n

    hxxp:\/\/haus-pesjak[.]at\/Covid-19Update.jar<\/p>\n\n\n\n

    hxxps:\/\/digitaltextile[.]com[.]ru\/lk\/Deutsche%20Telekom.jar<\/p>\n\n\n\n

    hxxps:\/\/digitaltextile[.]com[.]ru\/n\/DHL%20paket.jar<\/p>\n\n\n\n

    hxxp:\/\/haus-pesjak[.]at\/04-07-20Intuitinvoices.jar<\/p>\n\n\n\n

    hxxp:\/\/teddyshatsworld[.]pl\/Reylontransport-covid19-statement20.jar<\/p>\n\n\n\n

    hxxp:\/\/thaivictory[.]co[.]th\/pageconfig\/album\/dir\/5\/order.jar<\/p>\n\n\n\n

    hxxp:\/\/cherryemoore[.]com\/USPS\/RedeliveryUSPS.jar<\/p>\n\n\n\n

    hxxps:\/\/feylibertad[.]org\/Amazon-PO20023938.jar<\/p>\n\n\n\n

    hxxp:\/\/mahalowood[.]com\/USPS\/USPSReschedulerLabel.jar<\/p>\n\n\n\n

    hxxps:\/\/newsha[.]jsonland[.]ir\/wp-includes\/css\/DHLPaket.jar<\/p>\n\n\n\n

    hxxps:\/\/www[.]stillval[.]com\/USPS\/RescheduleUSPS.jar<\/p>\n\n\n\n

    hxxps:\/\/thediscoveryrun[.]com\/UPS\/ShippingInfo.jar<\/p>\n\n\n\n

    hxxp:\/\/jeddahcrumbly[.]com\/DHLPAKET.jar<\/p>\n\n\n\n

    hxxp:\/\/dev[.]medialogistics2020[.]ca\/wp-content\/plugins\/ubh\/Quickbooks-INV5066.jar<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Adwind RAT (Remote Access Trojan) is a cross-platform, multifunctional remote access program which is distributed through a single malware-as-a-service platform. One of the main features that distinguish the Adwind RAT from other commercial malware is its distribution openly in the form of a paid service, where the “customer” pays a fee for using the malicious […]<\/p>\n","protected":false},"author":1,"featured_media":1976,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1975","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=1975"}],"version-history":[{"count":2,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1975\/revisions"}],"predecessor-version":[{"id":4175,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1975\/revisions\/4175"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/1976"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=1975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=1975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=1975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}