Sarwent

The attacker-controlled homepage advertises the 'Amnesty Anti Pegasus' software... However, this alleged anti-virus software is actually a known remote access tool (RAT) called Sarwent.

It is clear the actor is attempting to deceive concerned users into downloading and installing the fake anti-virus. However, we haven't yet seen a malicious advertisement or phishing campaign to promote the fake.

It has several means of executing remote tasks, including remote desktop protocol (RDP) and Virtual Network Computing (VNC), despite the malware having shell and PowerShell execution capabilities.

After that, the adversary can issue commands via the command line or PowerShell or access the desktop remotely via VNC or RDP.

The malware then uses the following command to delete the aforementioned file: cmd.exe /c ping localhost & del /q

The ‘rdp’ command is a bit different; the code execution looks like it serves to tell the bot to perform a series of tasks: Add a new user

For persistence purpose (T1547.001), the malware creates a registry key in HKEY_CURRENT_USER

For persistence purpose (T1547.001), the malware creates a registry key in HKEY_CURRENT_USER

Threat actors are impersonating the group Amnesty International and promising to protect against the Pegasus spyware as part of a scheme to deliver malware. Adversaries have set up a phony website that looks like Amnesty International's.

it searches Windows registry for keys related to known virtualization tools such as VmWare or VirtualBox (T1497)

Moreover, the malware checks if it is currently debugged using CheckRemoteDebuggerPresent.

The ‘rdp’ command is a bit different; the code execution looks like it serves to tell the bot to perform a series of tasks: ... List groups and users

The malware also uses CreateToolhelp32Snapshot to enumerate running processes and then checks if the security analysis tools mentioned below are currently running in the system.

During the first communication, the malware exfiltrates some information about the victim, including the operating system version, whether anti-virus software is installed and the system architecture.

it searches Windows registry for keys related to known virtualization tools such as VmWare or VirtualBox (T1497)

Moreover, the malware checks if it is currently debugged using CheckRemoteDebuggerPresent.

Sarwent contains the usual abilities of a remote access tool (RAT) — mainly serving as a backdoor on the victim machine — and can also activate the remote desktop protocol on the victim machine, potentially allowing the adversary to access the desktop directly.

Sarwent contains the usual abilities of a remote access tool (RAT) ... and can also activate the remote desktop protocol on the victim machine... After that, the adversary can issue commands via the command line or PowerShell or access the desktop remotely via VNC or RDP.

It has several means of executing remote tasks, including remote desktop protocol (RDP) and Virtual Network Computing (VNC)... After that, the adversary can issue commands via the command line or PowerShell or access the desktop remotely via VNC or RDP.

After that, the malware will perform the regular beacon activity to the command and control (C2) site, which is hosted on the same domain.

these information are then send to the command and control (C2) server... sent to the C2 server via a specifically crafted URL... It is worth noting that the malware still uses the HTTP protocol.

It provides the attacker with the means to upload and execute any other malicious tools. Once the malware is executed, it contacts the domain medicalsystemworld[.]site. Then, it attempts to download another copy of itself if it needs to update later.

Likewise, it can exfiltrate any kind of data from the victim's computer. During the first communication, the malware exfiltrates some information about the victim.

The ‘rdp’ command is a bit different; the code execution looks like it serves to tell the bot to perform a series of tasks: ... Punch hole in local firewall