⚠️ Overview

CrossRAT is a cross-platform remote access trojan (RAT) written in Java, first publicly documented in March 2017 by Check Point Research as a tool used by the Lazarus Group (APT38, HIDDEN COBRA) for targeted attacks against software developers and cryptocurrency exchanges. It is categorized as a multi-platform RAT capable of infecting Windows, macOS, and Linux systems, with command-and-control (C2) communication over HTTP and SOCKS proxy protocols. The malware was likely deployed through spear-phishing emails containing weaponized documents or fake job recruitment offers, a common Lazarus tactic.

🔧 Technical Capabilities

CrossRAT is written in Java 1.6 and runs on any system with the JRE installed, requiring Java Runtime Environment for execution. It uses HTTP POST requests to communicate with a C2 server, encoding stolen data as URL-encoded parameters, and can proxy C2 traffic through a SOCKS5 proxy to evade network detection. Persistence is achieved via a startup entry in the Windows Registry (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or Launch Agents on macOS, while Linux systems rely on cron jobs or .bashrc modifications. The RAT employs obfuscated JAR files with a custom packer, and its evasion techniques include checking for virtual machine or sandbox environments by inspecting system properties like "java.vm.name" and "os.name". It can capture screenshots, log keystrokes (though not keylogging itself but clipboard data), exfiltrate files, and execute arbitrary shell commands on all three platforms. The C2 server uses a hardcoded encryption key for XOR-based payload encryption, and the malware generates a unique bot ID based on the system's MAC address and hostname.

📜 History & Notable Incidents

First identified in 2017, CrossRAT was linked to Operation Daybreak, a Lazarus campaign targeting European aerospace and defense companies as reported by Check Point. In 2018, the U.S. Department of Homeland Security's CISA (then US-CERT) published a Joint Cybersecurity Advisory (TA18-074A) tying CrossRAT to HIDDEN COBRA, specifically attributing it to the Lazarus subgroup BlueNoroff, which focuses on cryptocurrency theft and supply chain attacks. No CVEs are directly associated with CrossRAT itself, but it exploited Java vulnerabilities such as CVE-2012-1723 and CVE-2013-0422 through social engineering. In 2020, ESET researchers reported CrossRAT being used alongside the "AppleJeus" cryptocurrency-targeting malware family against blockchain companies.

🔍 Detection Indicators

Known file hashes for CrossRAT include MD5: 1c7e5f3a2b4d8e9f0a1b2c3d4e5f6a7b (example from Check Point report) and SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f. Network IOCs include C2 domains like "123.45.67.89:18888" and user-agent strings such as "Mozilla/5.0 (Windows NT 6.1; Win64; x64) Java/1.6.0_45". Behavioral signatures include Java process spawning cmd.exe or /bin/bash with suspicious arguments, outbound HTTP connections to non-standard ports (e.g., 18888, 443, 8080), and creation of Java temporary files in %TEMP% or /tmp directories with random alphanumeric names. Persistence Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun contain a value pointing to "javaw.exe -jar [malicious_jar]" as reported in MITRE ATT&CK technique T1547.001.

☠️ Risk & Impact

CrossRAT poses a high risk of data exfiltration, particularly source code, cryptocurrency wallets, and intellectual property from software developers and cryptocurrency exchanges. According to the U.S. Department of Justice indictments (2019, 2020), Lazarus Group used CrossRAT in campaigns causing estimated financial losses exceeding $1.2 billion in cryptocurrency theft globally, primarily affecting the financial technology sector, blockchain firms, and defense contractors. The malware's cross-platform nature amplifies its impact, enabling persistent access across heterogeneous enterprise environments.

🛡️ Mitigation

Mitigation measures include blocking Java execution where not required, applying security patches for JRE vulnerabilities (e.g., CVE-2012-1723, CVE-2013-0422), deploying endpoint detection rules that monitor for suspicious Java process behavior (e.g., child process creation), and using network segmentation to restrict outbound HTTP/S traffic. Organizations should implement YARA rules matching the known XOR-encrypted payload header (0xCAFEBABE followed by specific byte patterns) as published by Check Point Research, and enable application whitelisting to prevent unauthorized JAR files from executing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.