Java Remote Access Tools

Recently came across an attack campaign which looked quite unusual compared to the standard attacks normally seen in the wild. This campaign is targeting government agencies by sending phishing emails with a malicious attachment. Nothing new so far, except for one thing: the malicious payload is a Java remote access tool (RAT).

As we all know, cybercriminals tend to use recent hot media topics to entice users. In the case of this campaign they are using the recent news coverage surrounding the NSA surveillance program PRISM.
 

Figure 1. Phishing email example
 

The phishing email contains two legitimate non-malicious PDF documents and one Java file that mimics the name of a legitimate document. If a user is tricked into clicking this fake document, the Java applet will be run (providing that Java is installed on the user’s computer).

This applet is a RAT named jRat, it is available for free and Symantec detects it as Backdoor.Jeetrat. This threat can give full control of the compromised computer to a remote attacker. More importantly, because it is a Java applet the threat is able to run on multiple operating systems, not just Windows. In fact, the threat has a builder tool that allows you to build your own customized versions of the RAT, and we can see that when it comes to the targeted operating systems, the choice is very broad.
 

Figure 2. RAT builder control panel with options, including supported operating systems
 

The RAT can target not only Windows, but also Linux, Mac OSX, FreeBSD, OpenBSD, and Solaris (although we have not verified or observed the threat working on all of these operating systems). In principle, the threat may be able to run on any system that supports Java.

We searched our archives for other threats using the same command-and-control (C&C) server used in this specific attack and found an RTF document.
 

Figure 3. Malicious RTF document from previous attack campaign
 

This malicious RTF document exploits the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158), detected by Symantec as Bloodhound.Exploit.457. This shows that the same attackers were previously using the usual attack method of sending malicious documents that exploit some vulnerability in order to drop an executable payload but recently shifted to sending malicious Java payloads directly. The attack has been simplified as it does not involve the use of an exploit, nor an executable shellcode/payload, but simply relies on a Java applet. Nonetheless, it is no less dangerous than the older attacks and it can spread more easily since exploits are usually limited to work on specific versions of the vulnerable software and operating system, while this RAT can spread on any system where Java runtime is installed. In fact, not only has the attack been simplified, but it has also become more stable and more virulent, it is a big upgrade!

The distribution of this malware indicates most targets are located in the United States.
 

Figure 4. Malware distribution
 

Besides RATs, we have also seen other classes of Java malware being used in the wild. For more information about other uses of Java malware, check out this series of three blog entries about Java.Cogyeka.

In conclusion, while this new attack is a little unusual, it can be detected and blocked like older ones. We advise our customers to update their definitions and to be very cautious when receiving suspicious emails.

With the growing popularity of the Android operating system, it comes as no surprise that the Android OS is the latest target and is not immune to RATs. Since late last year, underground forums have been offering a free Android RAT known as AndroRAT (Android.Dandro). Now, unsurprisingly, the underground economy that caters to the needs of cybercriminals has created the first tools (called “binders”) that easily allow users to repackage and Trojanize legitimate Android applications with AndroRAT.
 

Figure 1. A “binder” tool being sold on underground forums advertised as the first binder ever
 

Back in November 2012, an open source RAT for Android named AndroRAT was published and made accessible to everyone on the Internet. Like other RATs, it allows a remote attacker to control the infected device using a user friendly control panel. For example, when running on a device, AndroRAT can monitor and make phone calls and SMS messages, get the device’s GPS coordinates, activate and use the camera and microphone and access files stored on the device.
 

Figure 2. AndroRAT’s control panel
 

The RAT comes in the form of an APK which is the standard application format for Android. When used in conjunction with the AndroRAT APK binder, it easily allows an attacker with limited expertise to automate the process of infecting any legitimate Android application with AndroRAT, thus Trojanizing the app. When the Trojanized version of the legitimate app is installed on the device, the user unsuspectingly installs AndroRAT alongside the legitimate app they intended to install. This allows the attacker to circumvent elements of the Android security model through deception. To date, Symantec has counted 23 cases of popular legitimate apps being Trojanized in the wild with AndroRAT.

Subsequently, we have also spotted a commercial Java RAT named Adwind (Backdoor.Adwind) that already supports multiple operating systems and seems to be in the process of incorporating an Android module based off the AndroRAT open source code. Again, this RAT also features a graphical user interface allowing the attackers to manage and control the RAT remotely.
 

Figure 3. Adwind main control panel
 

A demonstration video that shows Adwind working with Android also shows the presence of AndroRAT on the infected phone, suggesting that the authors of Adwind may be customizing the AndroRAT tool to incorporate it into Adwind. This development comes as no surprise, as the open source nature of the AndroRAT code means it can be easily customized into new threats and tools.
 

Figure 4. Screenshot of Adwind video showing AndroRAT’s presence on the infected device
 

At present, Symantec telemetry shows only several hundred infections of Android.Dandro worldwide, with the United States and Turkey being the most targeted countries. However, the telemetry is reporting a rise in infection numbers as of late, which we expect will continue as both the availability and sophistication of tools for AndroRAT increase.
 

Figure 5. Heat map of infections 
 

The evolution of remote access tools moving onto the Android platform was predicted. While AndroRAT is not showing a particularly high level of sophistication just yet, with the open source nature of its code and with its popularity growing, it has potential to evolve and grow into a more serious threat.

We recommend installing a security app, such as Norton Mobile Security, which detects this threat as Android.Dandro. For general safety tips for smartphones and tablets, please visit our Mobile Security website.