Java-based Malware Distributed Through Spam
For the past few months, we've observed more spam with Java-based malware attachments. The recent examples purport to be an invoice from a logistics company. The attachment is a .JAR file using a variety of filenames such as Authorized Invoice Cop.jar, Authorized Invoice.jar or Approved Invoice.jar.
The malware attachment is a Java application which requires a JRE (Java Runtime Environment) installed in the system in order for it to run. On the infected machine, the malware connects to a remote server with the domain name srv2.folgner.eu (IP address: 31.220.25.178 ) through port 1303. We have also noticed a few spam messages sent from the same server.
The .JAR packaged malware was built from a Java-based toolkit named jRAT (Java Remote Access Tool). It is capable of remotely taking control of the infected system and can be customized to run on Windows, Mac, Linux, and well-known UNIX flavors such as FreeBSD, OpenBSD and Solaris.
The toolkit is well known in the underground hacking forums and often used for malicious purposes. According to its description it states: "jRAT is a revolutionary rat combining the uses of a remote tool and java to ensure the ability to adapt to multiple systems at once". It features a fully undetectable (FUD) crypter to bypass detection, remote webcam viewer, keylogger, remote file manager and remote desktop viewer/controller.
The toolkit's control panel shows more interesting features that a cybercriminal can remotely control and execute in the infected system.
While RAT (remote access tool) software has legal uses such as by network administrators, it is also used for criminal and malicious purposes. Although, spam campaigns with Java-based malware attachments are not common, we advise users to be cautious when encountering .JAR file attachments. It is also recommended that email gateway policy should lock down executables like Java applications, especially in a corporate environment.
Trustwave's Secure Email Gateway customers were protected from this spam campaign without any additional action required.