jRAT is a piece of malware, also called a RAT (remote administration tool) or a trojan, that was recently made compatible not only with Windows but with Linux and MacOS as well .
jRAT (Java Based Remote Access Trojans) malware is not new but its activity has increased recently in the last few months and they are targeting various organizations.
These malicious JAR i.e., jRAT malware upon execution, result in infecting users. Let’s take a look at a detailed analysis of this malware.
Infection Chain
Here is an initial infection vector which is a spam email. As it looks legitimate, the user is tempted to download and open the attachment.
Below is a list of attachment names observed in these spam emails:
ITD_EFILING_FORM15CB_PR3.2.jar
MVD_SHPMNT_VSL_0004048_pdf.jar
Payment Swift Scan Copy 682017.pdf.jar
SHIPPING DOCUMENTS PDF.jar
SCAN DOC- 53862100.jar
FINAL COMPLETE SET OF SHIPPING DOCS.jar
PAYMENT_ADVISE_PDF.jar
PAYMENT_APLICATION_PDF.jar
After extracting the parent JAR file, it shows some java packages containing some long random filenames which contain raw data and class files. We have observed that malware actors are evolving malicious JARs with numerous obfuscations patterns. Some of the patterns are as follows:
Well-known decompilers failed to decompile the parent JAR file. Due to variation in obfuscation and encryption, (RSA, AES) makes static analysis more complex. Let’s see how malware behaves when it gets executed.
Execution of the parent JAR file drops two “.vbs”, two “.Class”, one “.Reg” and one “.dll” file at “%TEMP%” location. Every dropped file has a unique role in the infection cycle. Also, the parent JAR checks for a virtual machine using GlobalMemoryStatusEx() api which checks for the total physical and virtual memory available.
The parent JAR drops VBS files at %Temp% location with some random names. Also, it drops a JAR file with extension ‘.class’ at %Temp%. The parent JAR executes dropped the JAR file. The dropped JAR file is a jRAT malware.
Below images shows dropped vbs files:
Then jRAT malware executes VBS files using cscript.exe.
One of the VBS files enumerates a list of different firewall installed using WMI (Windows Management Instrumentation) functionality and the other one enumerates a list of third-party antivirus products using the same functionality upon execution.
The parent JAR also drops the “.Reg File” at %Temp% location and executes it using ‘reg.exe’. It creates registry entries of frequently used analysis tools such as ‘Procexp.exe’ ,’wireshark.exe’, ‘dumppcap.exe’ and some security products processes under “Image File Execution”. So, if any process gets started and if it has an entry under that key then the process gets killed.
Some registry entries are shown below:
jRat connects with CnC IP “213.183.58[.]42 ”. The below image shows the TLS-encrypted SSL traffic after infection. After decoding the TCP stream on port 3012, we found the blacklisted certificate which is associated with jRAT JAR.
the below image shows the SSL certificate information and it has an entry in the SSL Blacklist:
Prevention
In order to protect yourself and your organization against this threat,enterprises should review the purpose of using a Java platform and to disable it for all unauthorized sources. To be on the safe side make sure you are using advanced anti-malware solutions. Also pay attention to your cyber security awareness to make sure that you can identify phishing emails in your email box.