Cyble – New Java-Based Sayler RAT Targets Polish Speaking Users

Key Takeaways

Cyble Research and Intelligence Labs (CRIL) came across a Java Archive (JAR) file on VirusTotal with zero detection, and subsequent analysis revealed that it is a Remote Access Trojan (RAT) identified as “Sayler.”
Our analysis indicates that the Sayler RAT is intentionally designed to target Polish language users.
Sayler RAT comprises malicious features, including a Keylogger, Information Stealer, Screen Capture, Ransomware, and additional functions.
The Threat Actor (TA) employs a socket connection to facilitate communication between the client and server, enabling various functions such as data exchange, remote control access, and others.
The RAT includes Server GUI code and utilizes Discord for exfiltration.

Overview

On October 25th, CRIL came across an undetected Java Archive (JAR) file named “Java.jar” on VirusTotal. Upon investigation, it was determined that the JAR file is a new Remote Access Trojan named “Sayler.”

Sayler RAT is designed to provide covert remote access and control over a targeted computer. This RAT is stealthily installed on a system, giving the attacker the means to execute a range of unauthorized actions. These actions encompass taking control of the victim’s desktop, stealing sensitive data, capturing the screen, monitoring keystrokes, and even engaging in activities such as carrying out Ransomware attacks.

Upon further analysis, it becomes evident that numerous strings within the malware file are written in Polish. Additionally, the package name “pl.sayler” in the code also coincides with the two-letter country code “pl” for Poland. Furthermore, it’s worth noting that the file was submitted to VirusTotal from Poland. In conjunction, these factors strongly suggest that the JAR file may be designed for use in a campaign targeting Polish users.

Initial Infection

The origin of the Sayler RAT’s initial infection is unknown. The malware may infiltrate a user’s system through channels such as spam emails or deceptive phishing websites.

Technical Analysis

We have taken a Java Archive file named “Java.jar,” which has a size of 12.57 MB, for analysis.

The main class within the file is “pl.sayler.site.client.Client.” Inside this class, a main method is present, which internally invokes another method named “Client” with the parameters “host” and “port,” as illustrated in the figure below. This is likely intended to set up a communication channel with a remote server that is controlled by the attacker, serving purposes such as data exchange, remote access, and more.

Figure 2 Main method — Figure 2 – Main method

Settings

The figure below shows the Java class “Settings,” which contains various configuration settings of the malware. Notable settings include a Discord webhook URL for sending notifications, a file path for a keylogger, path for the file named “blocked” (this file is used to determine the computer’s state, indicating whether it is ‘blocked’ or ‘unblocked’), a version number, and options to enable or disable sound and menu notifications, as well as specifying whether packet communication should be asynchronous or synchronous.

Main Method

Upon execution of the .jar file, the main method invokes the Client() method with the arguments “host” and “port.” This method performs the main functionalities of the malware, as illustrated in the provided code snippet below.

Figure 4 Overall functions of the Client — Figure 4 – Overall functions of the Client

The Client() method first calls the registerGlobalScreenListeners() function, which sets up global input event listeners for keyboard and mouse events using the GlobalScreen library. These listeners capture low-level keyboard and mouse input events, allowing for the recording and handling of these events, typically for further processing or logging.https://) and ensuring the accurate spelling of domain names.

Deploy strong antivirus and anti-malware solutions to detect and remove malicious executable files.

Enhance the system security by creating strong, distinct passwords for each of the accounts and, whenever feasible, activate two-factor authentication.

Set up network-level monitoring to detect unusual activities or data exfiltration by malware. Block suspicious activities to prevent potential breaches.

Regularly back up data to guarantee the ability to recover it in case of an infection and keep users informed about the most current phishing and social engineering methods employed by cybercriminals.

MITRE ATT&CK® Techniques

Tactic	Technique	Procedure
Execution (TA0002)	Command and Scripting Interpreter: Windows Command Shell (T1059.003)	cmd.exe is used to run commands like taskkill.
Persistence (TA0003)	Registry Run Keys / Startup Folder (T1547.001)	Drops copy of the malware file to the %appdata% folder and adds Run registry entry.
Defense Evasion (TA0005)	Disable or Modify Tools (T1562.001)	The malware kills the Task manager and registry editor processes.
Defense Evasion (TA0005)	Modify Registry (T1112)	Modifying Windows registry.
Credential Access (TA0006)	OS Credential Dumping (T1003)	Tries to harvest and steal browser information.
Discovery (TA0007)	Process Discovery (T1057)	Queries a list of all running processes.
Discovery (TA0007)	System Information Discovery (T1082)	The malware gathers system information through various methods.
Discovery (TA0007)	File and Directory Discovery (T1083)	Enumerate files and folders for ransomware encryption.
Collection (TA0009)	Data from Local System (T1005)	Tries to harvest and steal browser information.
C&C (TA0011)	Non-Application Layer Protocol (T1071)	Using sockets for network communication.

Indicators of Compromise (IOCs)

Indicators	Indicator Type	Description
3a285221a2ee58369c4d39d2ee508b3d d04754ca5c9853d4f5688ddafd76b125306dd01b ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9	Md5 Sha1 Sha256	Java.jar
9f36aa7edd5e1f19b541f209386bc7ea ed51900e5b6bb58c116236aff1ed3dec4440702b 1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb	Md5 Sha1 Sha256	BlazeXHack.jar

Source: https://cyble.com/blog/new-java-based-sayler-rat-targets-polish-speaking-users/

Tags: WINDOWS, SOCIAL ENGINEERING, TROJAN, DEFENSE EVASION, DISCOVERY, PHISHING, CREDENTIAL, COLLECTION