{"id":75106,"date":"2018-02-02T17:38:21","date_gmt":"2018-02-03T01:38:21","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=75106"},"modified":"2018-02-05T08:06:40","modified_gmt":"2018-02-05T16:06:40","slug":"new-crossrat-malware-used-in-global-cyber-espionage-campaign","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/","title":{"rendered":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign"},"content":{"rendered":"

\"CrossRAT<\/p>\n

Researchers from the Electronic Frontier Foundation (EFF) and Lookout have\u00a0published a security research\u00a0report<\/a>\u00a0analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, “Dark Caracal Cyber-espionage at a Global Scale”\u00a0is detailed and makes for a good read. In it are details\u00a0about\u00a0a new piece of cross-platform malware, named CrossRAT, detected by\u00a0Intego VirusBarrier<\/a>\u00a0as Java\/LaunchAgent<\/strong>.<\/p>\n

CrossRAT is a Java-based backdoor that can be deployed on Windows, Linux and macOS systems and will be the focus of this article. Here’s what we currently know about this new CrossRAT malware and what you can do to protect yourself.<\/p>\n

How does CrossRAT malware install?<\/h3>\n

CrossRAT likely ends up on victim’s systems through social engineering<\/a>, phishing, and in some cases physical access. The use of Facebook groups and WhatsApp messages are\u00a0mentioned in the report as well as spear-phishing. It is unknown if fake or infected installers such as Flash Player were used. CrossRAT is Java based, and so infection through a web browser is likely the most common\u00a0way cybercriminals infect a target.<\/p>\n

Once the malicious file (hmar6.jar<\/i><\/span>) is successfully loaded on a target system, it checks the version of the operating system and installs the appropriate means to keep itself alive. The malware\u00a0then checks in with a\u00a0Command and Control (C&C) server, receives instructions and gets to work. The C&C server is known to be flexberry[.]com<\/span> and CrossRAT communicates with it on port 2223.<\/span><\/p>\n

Persistence is achieved by installing a LaunchAgent that links to a file placed in the user’s Library folder.<\/p>\n

What can CrossRAT do?<\/h3>\n

When CrossRAT first reaches out to the C&C server, it transmits several pieces of information:<\/p>\n