IceRat evades antivirus by using JPHP

[struppigel]

Content source

https://www.gdatasoftware.com/blog/icerat-evades-antivirus-by-using-jphp

I wrote this article based on @McMcbrad sample

IceRat keeps low detections rates for weeks by using an unusual language implementation: JPHP. But there are more reasons than the choice of the compiler. This article explores IceRat and explains a way to analyze JPHP malware.

User McMcbrad of the malwaretips.com forums discovered the first IceRat samples[5][7]. The malware caught his interest due to the low detection rates on VirusTotal for most related samples. At the time of discovery only 2 to 3 engines showed a detection despite the samples being a month old.

Static analysis reveals that most components of IceRat are written in JPHP. This is a PHP implementation that runs on the Java VM. This implementation uses .phb files instead of Java .class files -- a file type that, as I suspect, is not commonly supported by antivirus products. So far I haven't heard or found any other malware that uses JPHP which partially explains the low detection rates on VirusTotal.

...

 

[ForgottenSeer 89360]

Great and very detailed article!
And I am even mentioned there

 

[ForgottenSeer 89360]

Schadprogramm IceRat hat es auf Nutzerpasswörter und illegales Coin-Mining abgesehen und setzt dabei auf außergewöhnliche Strategien

Die Schadsoftware IceRat spioniert die Zugangsdaten von Nutzern für verschiedene Online-Dienste aus und kann bei einer Infektion ungewollt die Stromrechnung von...

www.pressebox.de

Schadprogramm IceRat hat es auf Nutzerpasswörter und illegales Coin-Mining abgesehen - Onlineportal von IT Management

Die Schadsoftware IceRat spioniert die Zugangsdaten von Nutzern für verschiedene Online-Dienste aus und kann bei einer Infektion ungewollt die Stromrechnung von Anwendern in die Höhe treiben - durch verdecktes illegales Coin-Mining.

www.it-daily.net

IceRat: il trojan “virtuale” che sfugge agli antivirus - Securityinfo.it

Il malware utilizza una macchina virtuale JavaScript per avviare un PHP che ne esegue il codice. Solo 2 motori antivirus su 3 lo riconoscono.

www.securityinfo.it

I don't speak Italian (last article), but I can see the article is making headlines.

 

[ForgottenSeer 89360]

ESET has renamed their detection. It was "variant of XXX", now it's IceRat.A
And Ikarus as well.

 

[ForgottenSeer 89360]

Spoiler: Broadcom IceRat Coverage