Acronis Threat Research Unit (TRU) ha New targeted, low-profile ransomware identified that uses advanced techniques such as obfuscation, dynamic modules and polymorphism to avoid detection
Acronis, global leader in the protection informatica, identified JanaWare, a new ransomware targeting Turkey via Adwind RAT. The Acronis Threat Research Unit (TRU) investigation began with the analysis of a custom variant of the Adwind RAT malware, suspected of being linked to ransomware activity. After collecting several JAR archives from VirusTotal, anomalous behavior of one of them emerged: while running in the lab, the sample dropped a ransom note in the Turkish language. In the note, the hackers invite victims to contact them through secure, private channels, such as qTox, a decentralized open source application with end-to-end encryption. In some campaigns, however, the use of the Tor browser was required to access dedicated .onion sites.
The infection sequence was reconstructed through the analysis of EDR telemetry. The attack begins with an email phishing campaign that tricks the user into downloading a malicious file. Specifically, the user opens an email in Outlook that launches Chrome to access a Google Drive link, from which a JAR file is downloaded and executed via javaw.exe.
Advanced techniques used to avoid detection
JanaWare is a low-profile, targeted ransomware operation that used advanced techniques to avoid detection. Although its prolonged activity remained little visible thanks to the limited geographical focus, the threat was, however, detected and blocked by Acronis EDR/XDR solutions.
Below are the advanced techniques used by JanaWare:
Obfuscation
Although Java bytecode is relatively easy to decompile, this becomes significantly more difficult when obfuscation is applied. Malware authors use several techniques, including custom class loaders. During the analysis, two publicly available obfuscators were identified: Stringer and Allatori. Fortunately, the open source java-deobfuscator project provides useful tools for bypassing the protections implemented by both.
Polymorphism
The malware also contains a class called FilePumper, whose purpose is to perform self-modification. Instead of simply copying itself to the target system during installation, the malware adds random content to its JAR archive, increasing its size by tens of megabytes. As a result, each deployed instance becomes unique, generating a different file hash on each infected machine. This technique hinders hash-based detection and signature comparison.
Configuration
At the beginning of the initialization process, the malware loads a set of hard-coded configuration parameters built into Java that define key aspects of execution behavior and communications. The configuration specifies the command-and-control (C2) infrastructure, including a domain and two TCP ports, used by the malware to establish and maintain the control channel. It also includes references to TOR-related routes and components, indicating that the malware can route traffic through this network. In this context, TOR is not related to payment mechanisms, but rather to network obfuscation and possible anonymous communications or data exfiltration. The configuration also contains a version identifier, suggesting that the malware is maintained as part of an evolving codebase, and a parameter (STARTUP_TYPE) that defines the persistence mechanism.
Geofencing
The malware is designed to exclusively target systems in Türkiye. Checks language, locale and IP geolocation, running only if the country code is “TR”. This approach reduces exposure and indicates targeted targeting. Overall, this geofencing mechanism suggests that the malware is not opportunistic, but part of a targeted campaign with a precise geographic scope, using location controls to both evade detection and ensure it operates only in intended environments.
File encryption
If the infected system passes geofencing checks, the malware initially weakens defenses by executing a series of PowerShell commands and registry changes. In particular, the malware disables defenses such as Microsoft Defender, suppresses security notifications, deletes Shadow Copies, blocks updates, hides ransomware protection features and detects installed antiviruses. Next download a module a ransomware plugin designed to work with this customized version of Adwind RAT. This module, also implemented in Java and responsible for encrypting files on all available drives, uses TOR exclusively for communication with the command and control server (C2) and is capable of not only encrypting files, but also deleting and exfiltrating them. During the handshake phase with C2 server, it uses the prefix JANAWARE, which is why it was named JanaWare Ransomware. After encryption, it drops a ransom note (“ONEMLI NOT” or “Important Note”) in multiple folders. Recovering files without access to the C2 server is highly unlikely.
For further information on the full investigation please see this link.
