Sarwent

The Sarwent malware first showed up in 2018. Back then, the Sarwent threat was a very basic piece of malware, which only served as a first-stage payload that allows the attackers to plant other threats on the infected computer. However, malware experts have spotted new iterations of the Sarwent threat that appear to be far superior to the earliest variants of this Trojan.

The latest variants of the Sarwent Trojan pack two main features, which were not available on earlier versions of the threat:

• They are capable of utilizing the PowerShell utility and the Windows Command Prompt service to execute remote commands on the compromised host.
• They are able to set up a new Windows user, which can be used to allow the attackers to use RDP (Remote Desktop Protocol) services and therefore access the host via an RDP connection.

This Week in Malware Ep8: Sarwent Malware #thisweekinmalware

Using an RDP connection to infiltrate the targeted system would allow the Sarwent Trojan to evade security measures as the firewall for the newly set up Windows user will not be configured appropriately.

So far, the cyber crooks behind the Sarwent Trojan have not utilized the RDP feature of the threat. However, this does not implies that they do not intend to use it as this feature would allow them to collect information, inject additional payloads on the compromised PC, plant a ransomware threat that will blackmail the user, etc. However, some cybercriminals opt to rent out or sell their creations rather than use them themselves. This is a common occurrence in the world of cybercrime. Selling or renting out hacking tools helps their creators generate revenue without exposing themselves to the potential negative repercussions that could follow if they execute the attacks themselves.

If the Sarwent threat has compromised your computer, it may be rather difficult to remove it completely as it applies certain major changes to the settings of the OS. However, if you use a reputable, modern anti-virus solution, you will be able to fully clear your system from the Sarwent Trojan. After removing the Sarwent threat from your PC, do not forget to remove the Windows account set up by this Trojan.