Trojanized Gaming Tools Deliver a Java RAT Through Browsers and Chat Platforms
Summary
Microsoft described trojanized gaming utilities delivering a Java-based RAT using PowerShell, with Defender exclusions and scheduled-task persistence. The article also reports Steaelite RAT capabilities and mentions DesckVB RAT and KazakRAT.
Key points
- Trojanized gaming utilities distributed through browsers and chat platforms are used to lure victims into running malware.
- A downloader stages a portable Java runtime and runs jd-gui.jar using PowerShell and cmstp.exe.
- The malware reportedly deletes its downloader, adds Microsoft Defender exclusions, and persists through a scheduled task and world.vbs.
- The RAT connects to 79.110.49[.]15 for command-and-control, data exfiltration, and additional payloads.
- Microsoft's recommended response includes auditing Defender exclusions and scheduled tasks, removing malicious startup scripts, isolating affected endpoints, and resetting credentials.
- BlackFog reported Steaelite RAT combines data theft and ransomware capabilities in a web panel; the article also mentions DesckVB RAT and KazakRAT.
Article Details
- Event Type
- Trojanized gaming utilities are being used to distribute a Java-based RAT; separate disclosures describe the Steaelite, DesckVB RAT, and KazakRAT families.
- Impact
- The reported attack can provide remote access, enable data exfiltration, and deploy additional payloads. Its operators configure Microsoft Defender exclusions and establish persistence. Steaelite is described as combining data theft and ransomware capabilities; KazakRAT is suspected of targeting entities in Kazakhstan and Afghanistan.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 79[.]110[.]49[.]15 | External command-and-control server contacted by the RAT for communications, data exfiltration, and additional payload deployment. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe RAT exfiltrates data over its command-and-control channel.T1053.005 · Scheduled TaskThe attack establishes persistence using a scheduled task.T1059.001 · PowerShellThe malicious downloader uses PowerShell to execute the Java archive.T1218.003 · CMSTPThe downloader uses cmstp.exe, identified in the article as a LOLBin, for stealthy execution.T1562.001 · Disable or Modify ToolsThe attack configures Microsoft Defender exclusions to evade detection.
People
Malware
Vendors
Products
Microsoft Defender Antimalware PlatformThe attacks delete initial downloaders, configure Microsoft Defender exclusions, establish persistence via a scheduled task and a world.vbs startup script, and connect to C2 at 79.110.49[.]15 to exfiltrate data andMicrosoft WindowsPersistence is achieved by means of a scheduled task and Windows startup script named “world.vbs,” before the final payload is deployed on the compromised host.