A few months ago I wrote about some Java RAT named QRypter (aka QRat or Qarallax) which is basically Adwind with some layers of obfuscation. The post is here.
Usually, this RAT is used as first stage of the infection. In a second stage additional payload is deployed in the victim. But before I explain this, let's take a look to the capabilities of this QRypter / Adwind.
This RAT written in Java is multiplatform. As it can be seen in the screenshot below is full of functionalities.
The basic options permits to have full visibility and take control on the victims's file system, processes, connections, etc
But besides that, there are more advance functionalities like capture the webcam, access via Remote Desktop, remote console, retrieve stored password, capture the microphone, key logger, SOCKS proxy, retrieve the data from wallets, etc.
For each of the functionalities, there is an existing module. The modules are original from JBifrost malware, so clearly this is based on JBifrost malware.
Also, the remote console is based on JBifrost
The remote desktop functionality permits also to add new users
But, if all this features are not enough, there is also the possibility to automatically download any additional payload once the victims connects to the C2. This allows to deploy any additional payload to the victims without any interaction in the C2
Actually, lot of AgentTesla and HawkEye are being deployed this way.
So, let's talk about a bit AgentTesla and HawkEye
This two families of malware are very close in terms of capabilities and are used by threat actors which operate with similar TTPs.
HawkEye and AgentTesla main target is to take screenshots of the victims, dump all the passwords stored in different programs (Outlook, browser, etc) and dump all the historical of cute&paste / keylog done in the system. The data is exfiltrated either via HTTP or via mail.
The first thing that happens, after a victim is infected via HawkEye, is that the threat actor receives an email informing that there is a new infection. This is a "Execution Confirmed" message. The content of such data is quite interesting as it contains information about the system, including the name of the file which was the infection vector, the private IP of the system the time frame to log and the functionality enabled.
On the other hand, AgentTesla already provides some data exfiltrated with information about the victim and screenshots in the first email. This is "screen capture"
HawEye provides 2 other messages: "stealer records" and "keylog records". The first one is password dumps, while the second one is all the information recorded in the clipboard and a screenshot
AgentTesla sends two additional set of data: "Keystrokes" and "password recovered".
(To be continued)
