Cyble Research and Intelligence Labs identified a Java RAT named Sayler, detected as a zero-detection JAR on VirusTotal, which targets Polish-speaking users and includes features like keylogging, information theft, screen capture, ransomware, and more, using a socket-based C2 channel and Discord for exfiltration. The malware embeds Polish strings and a pl.sayler package, suggesting targeted campaigns from Poland.
#SaylerRAT #Poland
#SaylerRAT #Poland
Keypoints
- The Sayler RAT was found as a Java Archive (JAR) on VirusTotal with no detections.
- It appears specifically designed to target Polish-language users, as indicated by Polish strings and the package name pl.sayler.
- Sayler includes capabilities such as keylogging, information stealing, screen capture, ransomware, and other functions.
- Communication relies on a socket-based client/server model to enable data exchange and remote control.
- The RAT contains Server GUI code and uses Discord for data exfiltration/notifications.
- Initial infection likely via phishing or spam, though the exact vector is unknown.
MITRE Techniques
- [T1059.003] Command and Scripting Interpreter – Windows Command Shell – cmd.exe is used to run commands like taskkill. (‘cmd.exe is used to run commands like taskkill.’)
- [T1547.001] Persistence – Registry Run Keys / Startup Folder – Drops copy of the malware file to the %appdata% folder and adds Run registry entry. (‘Drops copy of the malware file to the %appdata% folder and adds Run registry entry.’)
- [T1562.001] Defense Evasion – Disable or Modify Tools – The malware kills the Task manager and registry editor processes. (‘The malware kills the Task manager and registry editor processes.’)
- [T1112] Modify Registry – Modifying Windows registry. (‘Modifying Windows registry.’)
- [T1003] OS Credential Dumping – Credential Access – Tries to harvest and steal browser information. (‘Tries to harvest and steal browser information.’)
- [T1057] Process Discovery – Discovery – Queries a list of all running processes. (‘Queries a list of all running processes.’)
- [T1082] System Information Discovery – Discovery – The malware gathers system information through various methods. (‘The malware gathers system information through various methods.’)
- [T1083] File and Directory Discovery – Discovery – Enumerate files and folders for ransomware encryption. (‘Enumerate files and folders for ransomware encryption.’)
- [T1005] Data from Local System – Collection – Tries to harvest and steal browser information. (‘Tries to harvest and steal browser information.’)
- [T1071] Non-Application Layer Protocol – C2 – Using sockets for network communication. (‘Using sockets for network communication.’)
- [T1112] (Additional) Screen Capture – Collection/Impact – Screen capture functionality observed within the Sayler RAT. (‘Screen Capture functionality observed as part of Sayler.’)
- [T1056.001] Input Capture – Keylogging – Global input listeners capture keyboard/mouse events. (‘sets up global input event listeners for keyboard and mouse events using the GlobalScreen library.’)”
Indicators of Compromise
- [File Hash] Java.jar – MD5: 3a285221a2ee58369c4d39d2ee508b3d; SHA1: d04754ca5c9853d4f5688ddafd76b125306dd01b; SHA256: ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9
- [File Hash] BlazeXHack.jar – MD5: 9f36aa7edd5e1f19b541f209386bc7ea; SHA1: ed51900e5b6bb58c116236aff1ed3dec4440702b; SHA256: 1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb
- [File Name] Java.jar and BlazeXHack.jar – Observed in the same analysis context as Sayler RAT artifacts
Read more: https://cyble.com/blog/new-java-based-sayler-rat-targets-polish-speaking-users/