Summary

While the entire world is busy fighting COVID-19 pandemic, cybercriminals have latched onto the opportunity and used the theme to propagate numerous cyber-attacks. The latest in line is a targeted attack against co-operative banks in India. In April 2020, Quick Heal Security Labs observed a renewed wave of Adwind Java RAT campaign, whose primary target seems to be co-operative banks. These banks are usually small in size & may not have a large team of trained cybersecurity personnel, which, potentially, has made them a target for cybercriminals

As with a large percentage of COVID-19 related cyber-attacks, this recent Java RAT campaign also starts with a spear-phishing email. In this case, the email claims to have originated from either Reserve Bank of India or a large banking organization within the country. The content of the email refers to new RBI guidelines or a transaction, with detailed information in an attached file, which is a zip file that contains a malicious JAR file. Use of document file extensions (e.g. xlsx, pdf, etc.) in the name of the attachment, results in it appearing as an excel document or a PDF file, thus luring unsuspecting users into opening it. The JAR file is a remote admin trojan that can be run on any machine installed with Java including windows, Linux, and Mac.

Once the user opens the attachment, the malicious payload persists itself by modifying registry key and dropping a JAR file in %appdata% location. This JAR has multi-layer obfuscation to make analysis hard and bypass detection from AV products. Upon execution, this JAR file transforms into a Remote admin tool (JRat) which can perform various malicious activities such as keylogging, capturing screenshots, downloading additional payloads, and getting user information.

Infection Vector

As shown in the below figures, the attacker had sent spear-phishing emails to multiple co-operative banks using social engineering techniques. Assuming that this mail is from a trusted sender, the user opened the attachment.

 

 

 

As shown in the above emails, all attachments are zip files. After extraction of this archive, malicious JAR file gets unpacked. The name of JAR is impersonated to PDF, xls or xlsx. This impersonation lures the user to click on this JAR file resulting in the execution of Java RAT.

 

Below are some subject and attachment names found in the campaign:

Email Subject	Attachment Name
Urgent – COVID measures monitoring template	Covid_19_measures_Monitoring_Template-Final_xlsx.zip
Query Reports for RBI INSPECTION	NSBL-AccListOnTheBasisOfKYCData_0600402020_pdf.zip
Moratorium	Gazette notification&RBI_Directives_file-00000120_pdf.zip
FMR returns	Fmr-2_n_fmr_3_file_000002-pdf.zip
Assessment Advice-MH-603	MON01803_DIC_pdf.zip
[874890897] – MIS for NEFT/RTGS, 06-04-2020 [1]	FIXEDCOMPNULL_xls.zip
Deal confr.	SHRIGOVARDHANSING0023JI001_pdf.zip
DI form	DI_form_HY_file_00002_pdf .zip

Analysis of the JAR

Sample analysed: D7409C0389E68B76396F9C33E48AB72B

Attachment Name: Covid_19_measures_Monitoring_Template-Final_xlsx.jar

This JAR is obfuscated with multi-stage obfuscation —  let’s check analysis of the first stage.

Stage 1 JAR

This JAR file is obfuscated with Allatori obfuscator. As shown in below figure, all the strings are obfuscated.

 

After deobfuscating above JAR, code looks quite readable as shown in figure 5. We can see that the code is loading AES encrypted data from a file named bxcerhsdj.lsp using getResourceAsStream function. AES key is hardcoded in the code. This encrypted data becomes the second stage of JAR payload after decryption. This second stage JAR is dropped at %APPDATA% location and executed with java.exe.

 

 

It achieves persistence using registry run keys techniques.

Stage 2 JAR

Second stage JAR is responsible for all the major malicious activities. This JAR is again obfuscated with allatori obfuscator —  the package structure is as shown below in the below figure –

After deobfuscation of the above JAR, a new JAR is constructed as shown in fig 9:

 

With this deobfuscated JAR, we can easily perform static analysis of malware activities.

 

Analysis of RAT functionalities

For the ease of understanding, we have manually renamed some parameters and functions.

Configurations

Below class stores all the required configurations like URL for connection, port number, sleep intervals, current JAR name, etc. –

Connection mechanism

Adwind communicates with its command and control (C2) server on non-standard ports. It has hardcoded URL and port number. In this case, Port 9045 was used. It also schedules sleep before connecting to C2.

 

RAT has the functionality to terminate or restart the connection based on commands received from C2.

C2 Details

Domain was active between 05-Apr-2020 to 20-Apr-2020 hosted on IP ‘151.106.30.114’.

Figure 13: Domain heatmap. Reference – PassiveTotal

 Download Payload mechanism

Request for the payload is sent with “User-Agent” as:

“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36”

“dn” command is used for download functionality and “dn.e” command is used to download and execute the payload.

Pause-N-Go Mechanism

AdWind RAT has a pause & go mechanism which allows the RAT to schedule sleep before contacting the command-n-control server. This mechanism helps it to minimize its network activity when the C2 is off. The attacker can also cancel the scheduled sleep activity when needed.

“main” commands Mechanism

Three commands under ‘main’ that help attacker to Shut down, Reboot or log-off victim machine — all commands are executed as the victim OS.

 

 

Persistence Mechanism

This backdoor can create or delete its persistence by sending commands.

Persistence is created by adding its file path to the HKCU Run registry key using the reg command:

In case of clean-up, persistence can be removed by a command which calls ‘REG DELETE’ to current entry:

Remote Desktop Control

Adwind RAT is capable of controlling the victim’s desktop remotely. In this variant, the attacker used robot class to control mouse, keyboard by sending commands from a remote machine.

 Screenshots Capture

Below code is responsible to take screenshots.

 Below table shows different commands that can be sent from C2

Commands	Description	Sub-Commands	Description
aut	Authenticate
cm	Commandline
ln.t	Launcher.terminate
ln.rst	Launcher.Restart
png	Pause-N-Go
dg	Dialog
dn	Download	dn.e	Download & Execute
main	Main menu	main.shd	Shutdown
		main.rbt	Reboot
		main.lgf	logoff
st	startup	st.is	Add Reg
		st.us	Delete Reg
sc	Screen/Scroll Capture	sc.op	Open
		sc.ck	Mouse Click
		dblck	Mouse Double Click
		dn	Down
		up	Up
		sc.mv	Mouse Move
		sc.cap	Capture
		sc.ky	Keyboard keypress
		sc.mw	Mouse wheel
fm	Filemanager	fm.dv	Dir view
		fm.get	Get environment variable
		fm.nd	mkdirs
		fm.e	Execute
		fm.op	Open
		fm.sp	Spawn-Process with WMIC
		fm.ja	Execute Java App: java -jar <fie>
		fm.sc	Execute Script: wscript.exe //B <file>
		fm.es	Execute on cmd shell
		fm.cp	Copy
		fm.chm	Modifies File Permissions
		fm.mv	Move
		fm.del	Delete
		fm.ren	Rename
		fm.chmod	Modifies File Permissions
		fm.down	Download
		fm.up	Upload

Impact of Attack

When trying to assess the potential risk, banks should factor-in not just direct costs but many indirect aspects as well.

Direct Impact

Stolen Data

Cyberattack on banks can lead to stealing of all customer data and important financial infrastructure details. This data leak helps the attacker to plan the next phase of attack including targeted attacks.

Financial Fraud

Backdoors often lead to stealing of credentials for important financial infrastructure like swift logins. This further leads to big financial loses to banks. We have previously seen many incidences where banks had to face large financial losses due to cyberattacks.

Larger Attacks

During the last few years, there have been a few drawn-out & long duration cyber attacks on banks which had a huge financial impact on the bank & its users. Such attacks usually start with an initial infection that gives Cyber Criminals access to resources within the network, and from there the attack spreads laterally to the rest of the network till attacker gains access to sensitive/confidential information. The possibility of this Java RAT based being one such starting point should not be discounted.

Indirect Impact

Business Downtime

Cyber-attack may lead to the operational shutdown of banks, which may multiple times higher than direct costs like financial fraud.

Loss of Reputation

This is the most destructive type of cost a business has to pay for such cyber-attacks. A news leak about an attack leaves the victim with no choice but to make it known to the public that they have been breached. This can often change the potential views of investors and other stakeholders toward banks.

Customer Impact

Attacks on the bank can lead to the disclosure of customer personal data. Failure of transactions due to an operational shutdown may also lead to unhappy customers and may have negative consequences on retaining clients.

Conclusion

Since the last few months, Cyber Criminals are capitalizing on global coronavirus panic to distribute a variety of malware and steal sensitive information. In this particular scenario, attackers have used Adwind Java RAT to target small banks in India, with the explicit aim of stealing information and remotely controlling the victim machine for financial gains. Also, the attackers have used multi-layered obfuscation in this attack, to make detection harder. Seqrite products are successfully detecting & blocking these attacks though and keeping customers protected

Quick Heal advises users to exercise ample caution and avoid opening attachments & clicking on web links in unsolicited emails. Users should also keep their Operating Systems updated and have a full-fledged security solution installed on all devices. We recommend Seqrite customers to ensure they have email protection configured as per their organization policy — please reach out to Seqrite support using contact details mentioned here if assistance is required to configure email protection.

The quick Heal research team is proactively monitoring all campaigns related to COVID-19 and working relentlessly to ensure the safety of our customers

IOCs

• D7409C0389E68B76396F9C33E48AB72B
• 09477F63366CF4B4A4599772012C9121
• 8C5FFB7584370811AF61F81538816613
• 01AB7192109411D0DEDFE265005CCDD9
• 0CEACC58852ED15A5F55C435DB585B7D

 

MITRE ATT&CK TIDs:

Tactics	Techniques	ID
Initial Access	Spearphishing Attachment	T1193
Execution	Command-Line Interface	T1059
Persistence	File System Permissions Weakness	T1044
	Registry Run Keys / Startup Folder	T1060
Privilege Escalation	File System Permissions Weakness	T1044
Defense Evasion	Disabling Security Tools	T1089
	Modify Registry	T1112
	Obfuscated Files or Information	T1027
	File Deletion	T1107
	Process Discovery	T1057
	Remote System Discovery	T1018
	System Information Discovery	T1082
	Data from Local System	T1005
Collection	Input Capture	T1056
	Screen Capture	T1113
	Data Compressed	T1002
Exfiltration	Data Encrypted	T1022
	Uncommonly Used Port	T1065
	Remote File Copy	T1105
	Remote Access Tools	T1219
	Data Destruction	T1485
Impact	System Shutdown/Reboot	T1529

 Subject matter experts:

• Kalpesh Mantri

• Pavankumar Chaudhari

• Bajrang Mane