Java Malware Reconsidered, or, Java Brews a Fresh Bot of Malware

At Virus Bulletin 2011, we presented on the exploding level of delivered Java exploits this year with “Firing the roast – Java is heating up again”. We examined CVE-2010-0840 exploitation in detail, along with variants of its most common implementation on the web and some tools and tips for analysis. Microsoft’s security team presented findings for 2011 that mirrored ours in relation to Java exploit prevalence on the web – it is #1! At the same time, aside from the recent, well-known BEAST Java implementation, it is striking that it has been very uncommon to see Java backdoors, Trojans and spyware. But that lack of Java malware variety is beginning to change. My colleague, malware analyst Roman Unucheck, identified a new Java bot with some interesting characteristics that we named “Backdoor.Java.Racac”.

Our “Backdoor.Java.Racac” detection is delivered to the field, but no one shows a detection on Virustotal at this point (another upload wouuld remedy that). What makes this fresh Java sample interesting is its contemporary functionality set:

  1. Mobile Twitter Communications
  2. Effective encryption implementation – algorithms include private and public key use, cipher block chaining
  3. Exhaustive list of DDoS capabilities – HTTP Flooder, UDP Flooders, Raw Socket Flooder along with exhaustive SOCKS proxy capabilities to hide the true source of the bot infection
  4. Geolocation tracking and reporting
  5. Download and execute arbitrary code
  6. Ability to identify automated analysis tools and kill itself to delay family detection
  7. Proper AWT implementation of cross platform screenshotting
  8. Full cross platform portability – runs on Windows, Linux, Apple OS X
  9. Etc

This object oriented code is well developed and its style clear. The jar file itself is only 131 kb, which makes this java bot a size comparable to other common bots and RATs infecting victim systems. With samples like these, we can expect to see more java malware than the usual list of Java exploits that we’ve seen in 2011. We will be posting soon with more, unusual, and recent Java malware.

Java Malware Reconsidered, or, Java Brews a Fresh Bot of Malware

Your email address will not be published. Required fields are marked *



Lyceum group reborn

According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.

GhostEmperor: From ProxyLogon to kernel mode

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

Subscribe to our weekly e-mails

The hottest research right in your inbox