Developer cleans up Minecraft trojan

Powered by SC Magazine
 

Trend Micro spots RAT in Australia.

The developer behind a new remote access trojan (RAT) has moved to legitimise the app after security researchers claimed it was designed to steal passwords from the popular game Minecraft.

The current iteration of the Java RAT (jRAT) was designed to work on Windows machines but could be later designed to operate on Mac and Linux platforms.

Intego blogger Lisa Myers first reported on jRat last month which she found sniffing out Minecraft credentials.  

jRat

She pointed out it was capable of performing denial of service attacks, stealing passwords and directing users to websites “likely to perform clickfraud”.

Trend Micro’s anti-virus engines grabbed jRAT from an Australian user, one of two in the world found to have the app.  

Threat response engineer Johanne Demetria said in a post that it was more dangerous than Myers reported.

“We noted some JacksBot (jRAT) infection in the wild, indicating that the people behind this multiplatform malware are saving their best tricks for last,” Demetria wrote.

“When it was first reported, it was considered low risk and no actual infection was recorded.

"However, days after the report was released, Trend Micro successfully cleaned two infection counts; one in Australia and one in Malaysia. This indicates that the malware is now being distributed in the wild.”

The jRAT developer, using the handle Redpois0n, responded by claiming the application was not intended to be malicious.

Redpois0n published two applications — a reverse engineering tool which could extract jRAT servers from the app and a remover which would remove jRAT installations.

Redpois0n also stripped out the denial of service functionality and forced the tool to be visible when installed.

“This was made for controlling your own machines from distance, and I personally use it to transfer files from my laptop to my main computer,” Redpois0n said in a since deleted post.

“About the ‘denial of service attacks’, those features will be hidden or removed because you have pointed out they can be used for exactly that.

“About visiting remote URLs, is only a simple open website(s) on remote machine feature, nothing related to clickfraud.”

The move to legitimise jRat follows similar work by coder Jean-Pierre Lesuer who also last month stripped shady features from the popular DarkComet RAT.

DarkComet

Like jRAT, DarkComet was designed as a tool to help users access their remote machines, but it was also a favourite of criminals and was reportedly used in Syria to spy on activists.

DarkComet was stripped of the ability to configure a stub to target a computer and install silently, and of functions to “hijack the software and to commit illegal actions”, Lesuer wrote.

Copyright © SC Magazine, Australia


Developer cleans up Minecraft trojan
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  25%
TOTAL VOTES: 346

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 144

Vote