{"id":928,"date":"2020-05-25T18:22:55","date_gmt":"2020-05-25T17:22:55","guid":{"rendered":"http:\/\/zerothcode.com\/blog\/?p=928"},"modified":"2020-09-28T16:17:17","modified_gmt":"2020-09-28T15:17:17","slug":"hackers-abusing-open-rdp-ports-remote-access-using-windows-backdoor-malware","status":"publish","type":"post","link":"https:\/\/zerothcode.com\/blog\/hackers-abusing-open-rdp-ports-remote-access-using-windows-backdoor-malware\/","title":{"rendered":"Hackers Abusing Open RDP ports For Remote Access using Windows Backdoor Malware"},"content":{"rendered":"
Backdoor Malware- Recently, security researchers have discovered a new version of Windows malware that opens the RDP port on the Windows PCs for future remote access.<\/div>\n
<\/div>\n

The security researcher of SentinelOne, Jason Reaves, has revealed that this new version of malware is known as \u2018Sarwent,\u2019 and it has been in use since 2018. Backdoor Malware<\/h4>\n
<\/div>\n
Currently, this new version of the Sarwent malware is actively getting attention from several security experts.<\/div>\n
<\/div>\n
A tweet from the security researcher, Vitali Kremez, surfaced at the beginning of this year, 2020, in which he mentioned a few information about this Sarwent malware.<\/div>\n
<\/div>\n
\n
Security experts have also\u00a0clarified\u00a0<\/a>that it is not yet confirmed, exactly how Sarwent is distributed, it may be possible that this may happen through other malware.<\/div>\n
Backdoor Malware – Moreover, the earlier versions of Sarwent were developed to install additional malware on compromised PCs.<\/div>\n
<\/div>\n
Apart from this, the operators of Sarwent malware are most likely serving to sell access to these compromised systems on the hackers\u2019 portals and forums,<\/div>\n
as it\u2019s one of the most common methods to monetize the RDP-capable hosts.<\/div>\n

Sarwent Infection Functionality – Backdoor Malware<\/h2>\n
Sarwent malware is still being actively developed and used by the hackers, but, with new commands and a focus on\u00a0Remote Desktop Protocol\u00a0(RDP). The new version of Sarwent stands out for its ability to execute custom CLI commands through the Windows Command Prompt and PowerShell utilities.<\/div>\n
<\/div>\n
Although this new feature is highly intrusive on its own, but, the security experts have claimed that Sarwent also received another new feature with the update, and it\u2019s the ability to registers a new Windows user account on each infected host.<\/div>\n
<\/div>\n
Once Sarwent is active on a system, the malware creates a new Windows user account, modifies the Firewall, and then opens the RDP ports.<\/div>\n
\n
\"Backdoor<\/a>
Backdoor Malware<\/figcaption><\/figure>\n<\/div>\n
<\/div>\n
In short, the attackers will be able to use the new Windows user they created on the infected system to access the host without being blocked by the Windows firewall.<\/div>\n
<\/div>\n
According to the security researcher of SentinelOne, Jason Reaves, this is done in order to gain future remote access on the compromised system. This may involve the attackers themselves, but the investigator does not rule out the possibility that the RDP access is resold to other criminals.<\/div>\n
<\/div>\n
The limited number of original commands clearly shows that the functionality of this malware, \u2018Sarwent,\u2019 historically loops around being a loader, and here are the limited original commands:-<\/div>\n
<\/div>\n
|download|
\n|update|
\n|vnc|<\/div>\n
<\/div>\n
But, recently, the attackers have modified the Sarwent malware to add a few number of commands that mainly concentrate on the backdoor or RAT like abilities, and here are the new addition of commands:-<\/div>\n
|cmd|
\n|powershell|
\n|rdp|<\/div>\n
Apart from this, the operators behind Sarwent malware may use the RDP access for themselves only, to steal the proprietary data or install ransomware, or they can rent the RDP access to other hackers, as we told earlier.<\/div>\n

Indicators of Compromise (IOC)<\/h2>\n
Along with the description of the malware, the security expert at SentinelOne, Jason Reaves, has also presented the indicators of compromise (IOCs).<\/div>\n
<\/div>\n
Hash:
\n3f7fb64ec24a5e9a8cfb6160fad37d33fed6547c
\nab57769dd4e4d4720eedaca31198fd7a68b7ff80
\nd297761f97b2ead98a96b374d5d9dac504a9a134
\n106f8c7ddbf265fc108a7501b6af292000dd5219
\n83b33392e045425e9330a7f009801b53e3ab472a
\n2979160112ea2de4f4e1b9224085efbbedafb593<\/div>\n
<\/div>\n
An IOC is a sign to detect the presence of a specific threat like this within the network, and these include IP addresses, hashes, and domains.<\/div>\n
<\/div>\n
So, what do you think about this? Share your views and thoughts in the comment section below.<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/blockquote>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n","protected":false},"excerpt":{"rendered":"

Backdoor Malware- Recently, security researchers have discovered a new version of Windows malware that opens the RDP port on the<\/p>\n","protected":false},"author":1,"featured_media":929,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[37],"tags":[],"yst_prominent_words":[1413,1416,1412,1411,1420,1419,1421,1410,1407,1405,1402,1417,272,1409,1406,1415,1408,1418,1414],"class_list":["post-928","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hackers-news"],"_links":{"self":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/comments?post=928"}],"version-history":[{"count":0,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/928\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media\/929"}],"wp:attachment":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media?parent=928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/categories?post=928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/tags?post=928"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}