Procedure examples

jRAT can list local services.

jRAT can gather victim internal and external IPs.

jRAT can support RDP control.

jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.

jRAT payloads have been packed.

jRAT can be configured to reconnect at certain intervals.

jRAT can list and manage startup entries.

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

jRAT can list network connections.

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.

jRAT can query and kill system processes.

jRAT has command line access.

jRAT has been distributed as HTA files with VBScript.

jRAT has been distributed as HTA files with JScript.

jRAT has a function to delete files from the victim’s machine.

jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.

jRAT can browse file systems.

jRAT can serve as a SOCKS proxy server.

jRAT can download and execute files.

jRAT has the capability to take screenshots of the victim’s machine.

jRAT can capture clipboard data.

jRAT can map UPnP ports.

jRAT can capture microphone recordings.

jRAT has the capability to capture video from a webcam.

jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.

jRAT can steal keys for VPNs and cryptocurrency wallets.

jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.