{"id":84844,"date":"2017-10-03T18:08:25","date_gmt":"2017-10-03T12:38:25","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84844"},"modified":"2017-10-03T19:37:08","modified_gmt":"2017-10-03T14:07:08","slug":"evolution-jrat-java-malware-analysis-quick-heal-security-labs","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/evolution-jrat-java-malware-analysis-quick-heal-security-labs\/","title":{"rendered":"Evolution of jRAT JAVA Malware – An analysis by Quick Heal Security Labs"},"content":{"rendered":"

jRAT (Java Based Remote Access Trojans) malware is not new but its activity has increased recently in the last few months and they are targeting various organizations. Per day, Quick Heal Security Labs identifies thousands of spam emails carrying weaponized JAR as attachments targeting users. These malicious JAR i.e., jRAT malware upon execution, result in infecting users. Let\u2019s take a look at a detailed analysis of this malware.<\/p>\n

Infection chain<\/strong><\/p>\n

\"Fig
Fig 1: jRat Infection Chain<\/figcaption><\/figure>\n

Here is an initial infection vector which is a spam email. As it looks legitimate, the user is tempted to download and open the attachment.<\/p>\n

\"Fig
Fig 2: Spam Email<\/figcaption><\/figure>\n

Below is a list of attachment names observed in these spam emails:<\/p>\n