CrossRAT

CrossRAT is a Java-based, cross-platform remote access trojan/backdoor associated in reporting by Lookout and the Electronic Frontier Foundation (EFF) with the Dark Caracal cyber-espionage campaign. It targets Windows, macOS, and Linux and has been described as providing persistent remote command-and-control of infected systems in a global surveillance operation that targeted individuals and institutions across more than 21 countries, including governments, militaries, utilities, financial institutions, manufacturing companies, and defense contractors. Reported infection vectors for the broader Dark Caracal activity included social media, phishing, and in some cases physical access.

CrossRAT performs OS detection and host profiling, collecting data including OS name/version, username, and hostname. Its capabilities include filesystem enumeration and manipulation, creating, copying, moving, reading, and writing files, taking screenshots, and executing files or payloads. Screenshot capture is implemented via java.awt.Robot().createScreenCapture, with captured images saved as randomized .jpg files and exfiltrated to command-and-control. On Windows, execution of specified files has been reported via rundll32 with url.dll,FileProtocolHandler; on non-Windows systems it uses Desktop.getDesktop().open().

Persistence is platform-specific. On macOS, CrossRAT creates a LaunchAgent, writing mediamgrs.plist to /Library/LaunchAgents/ when running as root or ~/Library/LaunchAgents/ otherwise, configured to run java -jar on a persisted copy named mediamgrs.jar. On Linux, it creates an autostart entry named mediamgrs.desktop under ~/.config/autostart/ and uses /usr/var/mediamgrs.jar as an install path in the cited analysis. On Windows, it persists via HKCU\Software\Microsoft\Windows\CurrentVersion\Run using reg add and javaw.exe or java with -jar.

The malware’s main logic has been described as residing in crossrat/client.class. A hardcoded C2 endpoint of flexberry.com on TCP port 2223 was reported. Additional indicators directly mentioned in the content include the sample name hmar6.jar, persisted filename mediamgrs.jar, LaunchAgent name mediamgrs.plist, Linux autostart file mediamgrs.desktop, and MD5 hash 85b794e080d83a91e904b97769e1e770 for the referenced sample/persisted JAR. The content also notes that CrossRAT requires Java to be installed, which may reduce exposure on systems where Java is absent.