Back to blog Hiding in plain sight: New Adwind jRAT Variant Uses normal Java commands to mask its behavior Share this article Street magicians have a secret: If you want to hide something, hide it in plain sight. It’s how hidden card tricks, sleight of hand and most illusions work. Unfortunately, malicious actors are learning how to use the same concept to sneak malware past traditional cybersecurity tools and onto users’ computers. And, it’s causing havoc on two fronts: enterprise security and user productivity. An old jRAT evolves Four months ago we became aware of a new variant of Adwind jRAT, a remote access Trojan that uses Java to take control and collect data from a user’s machine–namely login credentials. Malware that takes advantage of common Java functionality is notoriously difficult to detect or detonate in a sandbox for the simple fact that Java is so common on the web. In fact, any effort to block or limit Java would result in much of the internet breaking down–a non starter for users who increasingly rely on rich web apps or SaaS platforms for their day-to-day responsibilities. While Adwind jRAT is typically platform agnostic, this new variant seems to be targeting Windows machines and common Windows applications such as Explorer and Outlook. Interestingly, Chromium-based browsers are also being targeted, including newer browsers like Brave. The malware is a JAR file delivered from a link in a phishing email or downloaded from a legitimate site serving up insecure third-party content. We also observed many infections originating from out-dated and illegitimate WordPress sites–a delivery method that is growing in popularity due to the vulnerabilities in the publishing platform. How Adwind jRAT works This new variant of Adwind jRAT works by obfuscating the initial JAR file, which makes any static signature-based detection ineffective. The initial JAR decrypts and reflectively loads the Qealler Header class which then decrypts and reflectively loads the Loader Class. The Loader Class then decrypts and reflectively loads the initial set of modules and calls the Main Class which is responsible for initializing the RAT with the control and command server. Adwind jRAT is then able to decrypt a config file to get a list of C2 server IP addresses. An address is selected, and an AES encrypted request is made via TCP port 80 to remotely load a set of additional JAR files. Once downloaded, the JAR files activate the jRAT which becomes fully functional and is able to send a command and control request to access and send credentials from the browser and various applications to a remote server. These credentials can include personal bank credentials or business app logins–basically any password saved in a browser or application running on Windows. Figure 1: The Adwind jRAT execution workflow uses common Java commands to deliver malicious payloads onto users’ devices. Malware Hiding in Plain Sight This latest variant of the Adwind jRAT trojan is able to mask its behavior by acting like any other Java command. Without dynamic construction of the initial JAR file, threat intelligence has very little or no heuristics with which to create a static rule or signature that can effectively detect the initial JAR payload among the millions of Java commands flowing in and out of the corporate network. It’s like wading through a crowd of a million people and trying to pick out the one person wearing a green undershirt without being able to look under people’s jackets. There’s nothing suspicious about its existence, its appearance or even its initial behavior. Everything about it seems normal. There is an exception, however. Viewing and sending stolen credentials to a remote server is definitely not typical behavior of a Java command. And that’s true with any sleight of hand trick. Eventually, the abnormal behavior has to reveal itself. Given that premise, it’s important to deploy a layered cybersecurity solution that provides complete cybersecurity protection throughout the network infrastructure. This layered solution should block known threats, isolate everything else in a remote browser in the cloud and then monitor traffic both inside and outside the organization for abnormal behavior. Cybersecurity attacks, like magic tricks, cease being mysterious once the delivery and method are revealed. Once you identify that abnormal behavior, it becomes easier to stop attackers in their tracks. Only a complete, layered cybersecurity solution can provide that level of protection for users. Learn how a Cloud Security Platform powered by Isolation is helping customers with their email and web security. Posted by Krishnan Subramanian on Oct 29, 2019 Email Share this article Related articles THREAT RESEARCH The cybersecurity demands of modern supply chains THREAT RESEARCH Report: How companies are approaching and adopting Zero Trust security strategies THREAT RESEARCH Holy SEO Poisoning Example: SolarMarker Malware Make the secure way to work the only way to work. To talk to a Menlo Security expert, complete the form, or call us at (650) 695-0695. Try Menlo Free Contacting about... Notify me of Launch Sales/Demo/Pricing Partnership/Channel Others Select Country ... United States Canada Afghanistan Aland Islands Albania Algeria Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia, Plurinational State of Bonaire, Sint Eustatius and Saba Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Cape Verde Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos (Keeling) Islands Colombia Comoros Congo Congo, the Democratic Republic of the Cook Islands Costa Rica Cote d'Ivoire Croatia Cuba Curaçao Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Falkland Islands (Malvinas) Faroe Islands Fiji Finland France French Guiana French Polynesia French Southern Territories Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guatemala Guernsey Guinea Guinea-Bissau Guyana Haiti Heard Island and McDonald Islands Holy See (Vatican City State) Honduras Hungary Iceland India Indonesia Iran, Islamic Republic of Iraq Ireland Isle of Man Israel Italy Jamaica Japan Jersey Jordan Kazakhstan Kenya Kiribati Korea, Democratic People's Republic of Korea, Republic of Kuwait Kyrgyzstan Lao People's Democratic Republic Latvia Lebanon Lesotho Liberia Libya Liechtenstein Lithuania Luxembourg Macao Macedonia, the former Yugoslav Republic of Madagascar Malawi Malaysia Maldives Mali Malta Martinique Mauritania Mauritius Mayotte Mexico Moldova, Republic of Monaco Mongolia Montenegro Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Norway Oman Pakistan Palestine Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Poland Portugal Qatar Reunion Romania Russian Federation Rwanda Saint Barthélemy Saint Helena, Ascension and Tristan da Cunha Saint Kitts and Nevis Saint Lucia Saint Martin (French part) Saint Pierre and Miquelon Saint Vincent and the Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Sint Maarten (Dutch part) Slovakia Slovenia Solomon Islands Somalia South Africa South Georgia and the South Sandwich Islands South Sudan Spain Sri Lanka Sudan Suriname Svalbard and Jan Mayen Swaziland Sweden Switzerland Syrian Arab Republic Taiwan Tajikistan Tanzania, United Republic of Thailand Timor-Leste Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates United Kingdom Uruguay Uzbekistan Vanuatu Venezuela, Bolivarian Republic of Viet Nam Virgin Islands, British Wallis and Futuna Western Sahara Yemen Zambia Zimbabwe Contact Us Get threat intelligence insights from Menlo. Email By clicking the subscribe button, you are agreeing to our privacy policy. Popular Resources Why Menlo Menlo Security Platform Products Solutions Menlo Labs Resources Blog Company About Us Leadership Customers Partners Technology Partners Life at Menlo Careers Contact Support Support Portal Report a Vulnerability Training & Certification © 2021 Menlo Security. All rights reserved. Privacy Policy Compliance EULA ask@menlosecurity.com (650) 695-0695 EN 日本語 한국어 By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. Accept All Cookies Cookies Settings