Developer cleans up Minecraft trojan

Powered by SC Magazine
 

Trend Micro spots RAT in Australia.

The developer behind a new remote access trojan (RAT) has moved to legitimise the app after security researchers claimed it was designed to steal passwords from the popular game Minecraft.

The current iteration of the Java RAT (jRAT) was designed to work on Windows machines but could be later designed to operate on Mac and Linux platforms.

Intego blogger Lisa Myers first reported on jRat last month which she found sniffing out Minecraft credentials.  

jRat

She pointed out it was capable of performing denial of service attacks, stealing passwords and directing users to websites “likely to perform clickfraud”.

Trend Micro’s anti-virus engines grabbed jRAT from an Australian user, one of two in the world found to have the app.  

Threat response engineer Johanne Demetria said in a post that it was more dangerous than Myers reported.

“We noted some JacksBot (jRAT) infection in the wild, indicating that the people behind this multiplatform malware are saving their best tricks for last,” Demetria wrote.

“When it was first reported, it was considered low risk and no actual infection was recorded.

"However, days after the report was released, Trend Micro successfully cleaned two infection counts; one in Australia and one in Malaysia. This indicates that the malware is now being distributed in the wild.”

The jRAT developer, using the handle Redpois0n, responded by claiming the application was not intended to be malicious.

Redpois0n published two applications — a reverse engineering tool which could extract jRAT servers from the app and a remover which would remove jRAT installations.

Redpois0n also stripped out the denial of service functionality and forced the tool to be visible when installed.

“This was made for controlling your own machines from distance, and I personally use it to transfer files from my laptop to my main computer,” Redpois0n said in a since deleted post.

“About the ‘denial of service attacks’, those features will be hidden or removed because you have pointed out they can be used for exactly that.

“About visiting remote URLs, is only a simple open website(s) on remote machine feature, nothing related to clickfraud.”

The move to legitimise jRat follows similar work by coder Jean-Pierre Lesuer who also last month stripped shady features from the popular DarkComet RAT.

DarkComet

Like jRAT, DarkComet was designed as a tool to help users access their remote machines, but it was also a favourite of criminals and was reportedly used in Syria to spy on activists.

DarkComet was stripped of the ability to configure a stub to target a computer and install silently, and of functions to “hijack the software and to commit illegal actions”, Lesuer wrote.

Copyright © SC Magazine, Australia


Developer cleans up Minecraft trojan
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 437

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 210

Vote