Skip to main content

Sarwent Remote Access Trojan

First observed in 2018, Sarwent is a PowerShell-based remote access trojan sold on a number of dark web forums. Initially developed as a backdoor, it has undergone several changes to improve its capabilities.

Threat ID:
CC-3470
Category:
Trojan
Threat Severity:
Medium
Threat Vector:
Published:
28 May 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in 2018, Sarwent is a PowerShell-based remote access trojan sold on a number of dark web forums. Initially developed as a backdoor, it has undergone several changes to improve its capabilities.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

  • Microsoft Windows - All versions

Threat details

At the time of publication, it is unclear how Sarwent is delivered, although there are reports indicating affiliate users may be targeting exposed or insecure RDP connections to distribute it.

Sarwent will perform several anti-virus and emulation checks when first executed, before connecting to a command and control server. It then collects user and system information to send to the server and awaits further commands. Sarwent will also attempt to set up a persistent RDP connection to allow affiliate users to upload secondary payloads to an affected system.

Remediation steps

Type Step

To prevent and detect a trojan infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

IP Addresses

  • 212.73.150.246

URLs

  • beurbn[.]com/install[.]exe
  • blognews-joural[.]best
  • blognews-joural[.]com
  • blognews-joural[.]info
  • blognews-journal[.]com
  • rabbot[.]xyz
  • rubbolt[.]xyz
  • rubbot[.]xyz
  • seoanalyticsp34roj[.]xyz
  • seoanalyticspro32frghyj[.]xyz
  • seoanalyticsproewj[.]xyz
  • seoanalyticsproj[.]xyz
  • seoanalyticsprojrts[.]xyz
  • seoanalyticsptyrroj[.]xyz
  • shopstoregame[.]icu
  • shopstoregames[.]icu
  • shopstoregamese[.]com
  • shopstoregamese[.]icu
  • softfaremiks[.]icu
  • startprojekt[.]pro
  • startprojekt[.]pw
  • tebbolt[.]xyz
  • terobolt[.]xyz
  • treawot[.]xyz
  • vertuozoff[.]club
  • vertuozoff[.]xyz
  • vertuozofff[.]club
  • vertuozofff[.]com
  • vertuozofff[.]xyz
  • vertuozoffff[.]club
  • whatsmyhomeworthlondonontario[.]ca/wp-admin/version[.]exe

SHA1 File Hashes

  • 3f7fb64ec24a5e9a8cfb6160fad37d33fed6547c
  • 106f8c7ddbf265fc108a7501b6af292000dd5219
  • 2979160112ea2de4f4e1b9224085efbbedafb593
  • 3eeddeadcc34b89fbdd77384b2b97daff4ccf8cc
  • 83b33392e045425e9330a7f009801b53e3ab472a
  • ab57769dd4e4d4720eedaca31198fd7a68b7ff80
  • d297761f97b2ead98a96b374d5d9dac504a9a134

Last edited: 29 June 2021 12:01 pm