Adwind 3.0 RAT Malware Sample with Java Payload

A new phishing campaign spreading Adwind 3.0 Remote Access Trojan (RAT) via Microsoft Excel. It targets Windows, Mac and Linux platform. On windows Adwind 3.0 uses Dynamic Data Exchange (DDE) code injection attack on Microsoft Excel. And in doing so it evades Anti-malware detection systems. The language of the emails are Turkish, which suggests that this RAT is tragted towards Turkey. As shown in the image below.

Adwind 3.0 Excel File Sample 1 Signatures

Family: TrojanDownloader:O97M/Donoff
MD5: 404fc4c276c7533b240e9325a34f7bff
SHA256: 0143b64f11346fab531951f7f1167a80e26728e6178676aacc9a58eca4b306d8

Adwind 3.0 Excel File Sample 1 Download

Adwind 3.0 Excel File Sample 2 Signatures

Family: HEUR:Trojan-Downloader.MSOffice.Dde.gen
MD5: 2a6dc0395edc8a7457d1eea2c8bc5caf
SHA256: 09c9ee0988af18b8df6123e439133df1356a88a7f0d890cb3b3e2414a427f4dd

Adwind 3.0 Excel File Sample 2 Download

Adwind 3.0 JAVA Payload Sample 1 Signatures

Family: Trojan:Win32/Casdet!rfn
MD5: ebc8c5c45af6f94e5af61f8667f7f284
SHA256: 0a2f74a7787ae904e5a22a3c2b3acf0316c10b95fae08cced7ca5e2fcc7d9bf8

Adwind 3.0 JAVA Payload Sample 1 Download

Adwind 3.0 JAVA Payload Sample 2 Signatures

Family: Trojan:Java/Ekselty.gen!A
MD5: d2932da10f6fd32fa99f5382ae618718
SHA256: 93a482e554e2a37e6893fdd8cd92537c0ebc7363ac5fac44b7a4af4a2088ea24

Adwind 3.0 JAVA Payload Sample 2 Download