TF-MAL-jar.jrat
📛 Threat Title
Malware family: jRAT
Description
ThreatFox malware family `jar.jrat`. Printable name: jRAT. Aliases: Jacksbot.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
jar.jrat
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/jar.jrat
IOC database
- Type
- domain
- Value
jar.jrat- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-jar.jrat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/jar.jrat
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.
-
web:bazaar.abuse.ch
Malware samples associated with tag JRat MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with JRat . Database Entry
-
web:malpedia.caad.fkie.fraunhofer.de
jRAT , also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT , because of of a red hering reference to jrat .io.
-
web:misp-galaxy.org
jRAT - S0283 (efece7e8-e40b-49c2-9f84-c55c5c93d05c) jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model. (Citation: Kaspersky Adwind Feb 2016) (Citation: jRAT Symantec Aug 2018)
-
web:safety.army.mil
Tools Army Readiness Assessment Program (ARAP) Joint Risk Assessment Tool ( JRAT ) Risk Management Magazine Safety Brief Tools Safety Campaigns Unit Safety Officer Guide
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.startupdefense.io
The malware can create startup items that ensure its Java-based payload executes each time the system boots. While jRAT uses multiple persistence mechanisms across platforms, on macOS it has leveraged the StartupItems directory when available on compatible macOS versions. What is the most effective mitigation against Startup Item abuse?
-
web:www.trendmicro.com
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.