JAVA_JACKSBOT.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following command(s) from a remote malicious user:

• Capture Screenshot
• Visit Remote URLs
• Manage files and directories
• Download arbitrary files
• Execute files
• Upload files
• Update and uninstall itself
• Manage Processes
• Upload file
• Perform shell command
• Perform Denial of Service attacks
• Displays Messagebox
• Shutdown, lock, sleep, logout & restart computer
• Get Hardware/ System Informations
• Record Audio
• List Installed Applications
• Steals User Informations (Minecraft)
• Log keystrokes and mouse strokes
• Get Network Information

It connects to the following websites to send and receive information:

• jacksbotlist.{BLOCKED}p.info:1336

NOTES:

This backdoor checks the operating system (OS) used. Depending on the OS version, this backdoor does the following to enable its automatic execution at every system startup:

For Windows:

It adds the following registry entry:

HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run
Microsoft® Windows® Operating System = "{Java Root Directory}\bin\javaw.exe -jar "{Malware Path and File name}""

For Mac:

It adds the following command in /etc/rc.local file:

• java -jar "{Malware Path and File name}"

For Linux:

It adds the following command in /etc/rc.common file:

• java -jar "{Malware Path and File name}"

Based on the analysis of the code, this malware still can add more capabilities by adding commands in "plugins.dat".