Analysis by: RonJay Kristoffer Caragay
ALIASES:

JAVA/Qrat.b (McAfee); Trojan.Maljava (Symantec); Mal/JavaJar-A (Sophos); a variant of Java/Kryptik.C (ESET-NOD32);

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 88,547 bytes
File Type: JAR
Memory Resident: Yes
Initial Samples Received Date: 10 Aug 2015

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor drops the following copies of itself into the affected system and executes them:

  • %Application Data%\syslogdata\syslog-Agent.jar

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

  • %Application Data%\syslogdata\blockedAgentMacAddresses
  • %Application Data%\syslogdata\macidAgent
  • %Application Data%\syslogdata\lastAgentMacAddresses

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

  • %Application Data%\syslogdata
  • %Application Data%\syslogdata\exc
  • %Application Data%\syslogdata\lib
  • %Application Data%\syslogdata\macnames
  • %Application Data%\syslogdata\pluginsAgent
  • %Application Data%\syslogdata\tempAgent

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
QRat-StartUp-Command = ""{Java installation folder}\javaw.exe" -jar "%Application Data%\syslogdata\syslog-Agent.jar" manageragent"

Other Details

This backdoor connects to the following possibly malicious URL:

  • {BLOCKED}ye.com
  • {BLOCKED}n.co
  • {BLOCKED}e.com
  • {BLOCKED}s.com.ru
  • {BLOCKED}a.com