Qealler – Heavily Obfuscated JAR-based Password Stealer Malware Delivered Through Invoice-related Files

A new highly obfuscated malware dubbed Qealler designed to steal sensitive information from the infected machine. The malware is written in java.

The initial attack starts with social engineering technique, attackers send the victim a malicious JAR file disguised as an invoice-related file, when the user double-clicks to open the file, then malware will get downloaded from a compromised site.

Zscaler initially observed the campaign on Jan 21, 2019, and the malware is active for more than 2 weeks.

The JAR files were heavily obfuscated using an open source command-line tool ProGuard that shrinks, optimizes and obfuscates Java code.

Upon execution of malware, a file will be downloaded and saved to %USERPROFILE% if the directory doesn’t exist it creates the directory and stores the file in the encrypted file in the same location.

%USERPROFILE%\a60fcc00\bda431f8\a90f3bcc\83e7cdf9 (/lib/7z)
%USERPROFILE%\a60fcc00\bda431f8\a90f3bcc\db2bf213 (/lib/qealler)

Along with the two downloaded files, a unique machine ID is generated in another file path. The 7z file contains a repackaged version of 7za[.]exe and additional DLL files.

The 7-zip executable is called by the main sample and the downloaded Qealler module is a password-protected file, that opens after applying the password.

QeallerQealler

Executed Qealler module contains Python 2.7.12, in case python framework not present in the user system it will install the module and also creates a directory named QaZaqne.

The extracted Remittance[.]jar executes a python file main[.]py, which steals the credentials on an infected Windows machine. The scraped information from the C&C server is encrypted and encoded with BASE64 and sent to the command-and-control (C2) server.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation

The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov, 48,…

43 minutes ago

Fortinet Zero-Day Under Attack: PoC Now Publicly Available

FortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products,…

1 hour ago

Global Crackdown Nets 270 Dark Web Vendors in Major Arrests

A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the criminal…

2 hours ago

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory…

2 hours ago

CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications

Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on…

15 hours ago

Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI)…

15 hours ago