Thursday, April 18, 2024

Java Malware “jRAT” Evolving with Highly Obfuscation Patterns

Java Based Remote Access Trojan Called “jRAT” Rapidly Evolving with Advanced Capabilities and Targeting Many Organization Sensitive information that spreading with Highly Obfuscation Patterns.

Nowadays, Advanced Threats are Mostly Spreading via Spam Campaigns same as this jRAT has Spreading via Spam Emails That has Rapidly Distributing across the Globe.

This Java Based RAT Infecting users with some sophisticated Techniques Such as Disable Firewall, Disable Analysis Tools, secretly  Spying users Activities with High Obfuscation Techniques to Evade to Antivirus Engines Detection and other Detection methods such as anti-debugging and anti-VM’s techniques.

Also Read: Hackers Hidden Backdoor Inside of Malicious WordPress Security Plugin

How Does jRAT Java Malware Infection Chain Works

Initially jRAT Spreading Via Spam Email Campaign along with some Legitimate Body Contents with Attached Parent JAR File and later it will be Extracted to Analyse the Associate File.

After Extracting Parent JAR File, its Show Some e long random filenames which contain raw data and class files with numerous obfuscations patterns.

According to Quick Heal, Since it has some variation in obfuscation and encryption, (RSA, AES) makes static analysis more complex and Well-known decompilers failed to decompile the parent JAR file.

Further Dynamic Analysis of jRAT drops two  “.vbs”, two “.Class”, one “.Reg” and one “.dll” file at “%TEMP%” location when jRAT Executed in Isolated Virtual Environment.

Security Softwares Detection Bypass

After Analysing the jRAT Drops Files, It Reveals that Malware Authors are using some advance Obfuscation patterns which are Capable of Evade to Bypass the AntiVirus and Firewall Detection. Aso It Enumerates the list of different firewall installed using WMI (Windows Management Instrumentation) functionality.

Quickheal Said, The parent JAR also drops the “.Reg File” at %Temp% location and executes it using ‘reg.exe’. It creates registry entries of frequently used analysis tools such as ‘Procexp.exe’ ,’wireshark.exe’, ‘dumppcap.exe’ and some security products processes under “Image File Execution”. So, if any process gets started and if it has an entry under that key then the process gets killed.QuickHeal Said.

Once parent JAR executes the jRat JAR file, it will communicate with Command & Control Server to Download and Execute the Payload.

It uses auto-run registry isan Entry Point to keep Launch Every time whenever System will be Rebooted.

Its uses the ” “213.183.58[.]42 ” as a C&C Communication Sever and Further  Investigation Revealed that it uses blacklisted certificate which is associated with jRAT JAR.

An indicator of Compromise:

  • 213.183.58.42
  • 781FB531354D6F291F1CCAB48DA6D39F
  • 0B7B52302C8C5DF59D960DD97E3ABDAF
  • 938CF1BA5F8BDB516B5617826E0B08A1
  • 76985223E94342D0FAB80D8A4DB1707C
  • JAR.Suspicious.A
Website

Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles