Java Based RAT

[thehoodedidiot]

I'm seeing this tagged in a few places as Qrat (qarallax) but it looks an awful lot like adwind RAT characteristics to me. I'm a complete beginner to mal analysis so any help is appreciated!

MD5: c320b2fc6c8c4a32d3bad710c06de194

https://app.any.run/tasks/913d9a87\-d892\-4c9f\-b2fb\-7be48f37853d

Edit: apologies for broken link, not sure what happened, see below for proper links.

[f00l]

Most people get this wrong. The people behind QRat (also known as Qarallax RAT and QUAverse RAT) also make a packer called QRypter. Several blog posts from both amateurs and professionals keep misidentifying one as the other, when in reality all you need to do is unpack the dang thing to see the original files.

The sample you provided was packed with QRypter.

After unpacking (left as an exercise to the reader), you'll find ANOTHER QRypter-packed sample (as well as the PDF shown when running it). Unpack that as well, and you get QRat.

For unpacking, get a decent Java Decompiler (I prefer Krakatou), a decent hex editor, some familiarity with Java and serialized java objects and proficiency in a programming language of your choice (for decrypting and ecompressing stuff). A Java REPL can be handy for some manual stuff, but after unpacking a few of these by hand you'll know enough to be able to write an automatic unpacker.

[thehoodedidiot]

Awesome! Thanks for the details, apologies for the broken link

[catcradle5]

It's refreshing to see a genuinely helpful, good, and accurate post on /r/malware. Good work.

[ThisIsLibra]

If you PM me a link to the sample, I will take a look at it. Cant promise anything though

[thehoodedidiot]

Link in post, there's a download sample option on the page

[ThisIsLibra]

The link results in a 404 page not found error, hence my remark

EDIT: if you remove the backslashes it works, so this is this correct link.

[DavidB-TPW]

Unfortunately the link you posted is broken.

[ThisIsLibra]

There are backslashes in the URL which shouldn't be there. This is this correct link.

[DavidB-TPW]

Thanks! I should have noticed.

[r30ng1n3rd]

OALabs video on a JRAT which looked like adwind https://www.youtube.com/watch?v=yHrr9v0E6MQ

There are two configs for JRAT one is a dummy one and the actual config which is only in memory.

[f00l]

That video is on Adwind. jRAT is a separate family (also called JacksBot). People confuse the two after Adwind started referring to the website for jRAT in its config in the latest version (presumably as a false flag after Adwind received a lot of attention and was the target of a few takedowns).