Summary
Investigating a Malicious .jar file Hello guys, I’m back with another writeup. First of all, can you tell me why Ronaldo is out of the World cup? I could not sleep that day. Anyways.. that was just btw. Today’s lab was from LetsDefend. I realized its been a while I solved their labs hence checked out Samba spy and decided to make my writeup for it. Relax and follow along. If by any chance you found this helpful, you can give this a clap and hit the follow button to get notified anytime I post a walkthrough or writeup. (I usually interchange those words lol) Scenario Your organization has discovered an infection on one of its systems involving a malicious Java application. This malware performs environment checks to ensure it is not running inside a virtual machine and targets systems with specific configurations. Once the required conditions are met, it extracts files and executes malicious components that could compromise sensitive data or system integrity. Objective Uncover the the stealthy nature of the malware and its ability to evade detection which pose a serious threat, to secure the network and prevent further compromise. Tools
- Java Decompiler Methodology What is the name of the method that checks if the program is running inside a virtual machine? I started by extracting the contents of the provided ZIP file, which returned a .jar file. Since the goal was to “uncover the stealthy nature of the malware,” decompiling the artifact was the logical first step. In the lab console, I selected Java Decompiler (JD) to open the .jar file. Once opened, the left panel displayed several classes. I expanded JavaApplication1.class to explore its methods and understand the malware’s logic. Scrolling through the methods, I noticed one that stood out: isRunningInVM(). Answer: isRunningInVM This method checks for virtualization indicators , allowing the malware to change its behavior if it detects a virtualized environment (essentially, it’s trying to fool the analyst). What system language is required for the program to continue execution? I performed a quick search for the keyword language within the decompiled code. I found that the malware checks if the system language is Italian before proceeding with execution. This is a geo-targeting technique likely to avoid detection in non-target regions. Answer: Italian What is the name of the method responsible for extracting the Prodotto.zip file? Searching for Prodotto.zip within the decompiled code, I found it referenced inside the extractLibs() method. This method handles the extraction of the malicious payload. Answer: extractLibs What is the default extraction path for the Prodotto.zip contents? Looking inside the extractLibs() method, the very first line specified a destinationPath: destinationPath = “C:\Users\Public\” So the malware drops its contents into a common public directory likely to avoid raising suspicion. Get Prince Lassey’s stories in your inbox Join Medium for free to get updates from this writer. Answer: C:\Users\Public What file name does the program look for after extraction to run as a JAR file? Back in the main class, I traced the flow: after checking for virtualization and system language, the program looks for a file in the same extraction path (C:\Users\Public). That file is declared as jarPath and is named Prodotto.png. Yes, it’s a .png file masquerading as a JAR (classic trick to bypass file-type filters and user suspicion) Answer: Prodotto.png What command is used to execute the extracted JAR file? From the previous question, we identified the path for the masqueraded jar file declared as jarPath. A few lines below the jarPath declaration, I found a process builder that clearly executes: Answer: java -jar C:\Users\Public\Prodotto.png This confirms that the malware uses Java to run the disguised .png as a JAR. What process is used to check if the system is running in a virtual machine (besides the manufacturer string)? Initially, I had identified that the isRunningInVM() method which firstly used the manufacture string for that check. You would realize there was Microsoft Corperation, among others. This time, I need to find another method by which the malware checked for virtualization. A couple of lines below the manufacturer method was another method “wmic baseboard get manufacturer” as seen in the image below. That command retrieves the motherboard manufacturer, which is another reliable indicator of virtualization. Answer: wmic baseboard get manufacturer How many virtual machine vendors does the program check for? The program explicitly checks for four vendors:
- Microsoft Corporation
- VMware, Inc.
- Xen
- Oracle Corporation These cover the most common virtualization platforms (VirtualBox, VMware, Xen, and Hyper-V) Answer: 4 Reflection Completing the Samba Spy challenge on LetsDefend was more than just answering questions.. it was a a solid approach in understanding how a malicious Java application operates. The process walked me through the entire lifecycle of a Java-based threat, from initial decompilation to unpacking its evasion tactics and execution chain. When I first opened the .jar file in the Java Decompiler, I was struck by how clearly the code revealed its malicious intent which was almost like reading the attacker’s playbook . What made this challenge particularly valuable was the opportunity to map the malware’s behavior directly to the MITRE ATT&CK framework. Identifying specific techniques helps defenders understand what the malware is doing and, more importantly, why. The malware employs several key techniques that correspond to specific MITRE ATT&CK tactics:
- Virtualization/Sandbox Evasion (T1497): The isRunningInVM() method was the malware’s first line of defense. By checking for vendors like VMware, Microsoft, Xen, and Oracle, it actively evades analysis environments. The additional wmic baseboard get manufacturer query is another well-known VM detection method, often used by malware to fingerprint the underlying hardware .
- System Information Discovery (T1082): Beyond just checking for a VM, the malware gathers specific system information, including the system language. Requiring Italian before proceeding is a form of geo-targeting, ensuring the malware only executes on systems within its intended victim pool.
- Masquerading (T1036): The malware masquerades a png file. After extracting Prodotto.zip to the C:\Users\Public directory, it looks for Prodotto.png to run as a JAR . This is a deliberate attempt to disguise a Java archive as a benign image file, bypassing both user suspicion and basic file-type filters.
- Command and Scripting Interpreter (T1059): The final execution step (java -jar C:\Users\Public\Prodotto.png) directly uses the Java interpreter to run the masqueraded file. This technique leverages a legitimate, built-in tool (Java) to execute arbitrary code, a common tactic that makes detection more challenging. Viola! See you in my next post.