Inside JBootstrap: A Rust-Based Loader Hiding a Full Java RAT

Recently, the SonicWall Capture Labs Threat Research Team discovered a Rust-based malware that delivers a Java RAT through a multi-stage execution chain, leveraging Java runtime components. 

Initial File Analysis:

The main executable is a 64-bit exe compiled from Rust. Static analysis reveals a ( .rdata section) containing embedded data. Tracing the binary's internal logic reveals what's embedded inside.

These strings indicate that payload.jar is embedded directly inside the main executable’s  .rdata section. The presence of Java class names such as dev/jbootstrap/payload/... in the .rdata section provided an initial indication that Java payload data was embedded within the executable.

Java Runtime Installation:

The malware uses a fallback mechanism to obtain the required Java runtime. It first attempts to download the runtime from g-88741[.]com/api/v1/bootstrap/jre. If the request fails, it falls back to api.adoptium.net, a legitimate Java distribution service.

Payload Extraction:

The Rust binary embeds payload.jar directly in its .rdata section. During execution, it locates this data and writes the JAR file to disk. The routine responsible for this step is internally labeled payload-extract.

The binary extracts the embedded payload.jar from the .rdata section and writes it to %LOCALAPPDATA%\OpenRoaming\runtime\open-roaming\. The same directory also contains supporting components, including JNativeHook.x86_64.dll for keystroke capture, classpath.args, identity.properties, and a .payload-sha256 file used to verify the payload’s integrity.

Execution of Payload:

The binary loads the address of a text blob stored in .rdata and passes it, with a length of 0x64E (1614 bytes), to a routine that copies it into a new heap-allocated string.

The blob is a default TOML configuration in the binary's .rdata section, spanning exactly 0x64E (1614) bytes, the length passed to the copy routine in Figure 6. It sets embedded_jar = true (the payload jar is stored inside the exe and extracted at runtime), names dev.jbootstrap.payload.OpenRoaming as the main class and requires Java 21 with allow_system = false, so the launcher ignores any installed Java and uses its own Temurin runtime under %LOCALAPPDATA%\OpenRoaming\jdks.

The payload starts with javaw.exe, the standard Java launcher without a console window, from the private Temurin JRE (Figure 7). The command line runs payload.jar with dev.jbootstrap.payload.OpenRoaming as the main class, hides the window (0), and does not wait for the Java process to exit (False). It also passes -Djbootstrap.* properties, including baseUrl=hxxps://g-88741[.]com, the configured C2 endpoint, plus ownerId and buildTag identifiers.

Java RAT:

Decompiling payload.jar reveals the malware's full scope. The JAR contains a fully featured Remote Access Trojan organized under the dev.jbootstrap.payload package. Its version string is 1.0.71-copyfix.

The Java payload includes a remote shell component capable of executing commands through either Windows Command Prompt or PowerShell. PowerShell commands are Base64-encoded and executed using Invoke-Expression with ExecutionPolicy Bypass.

Analysis of the Java payload identified multiple remote-control capabilities, including keystroke logging, VNC-based remote desktop access, webcam access, command execution, file-system operations, browser credential theft, memory manipulation, and privilege-escalation functionality. The agent can receive commands from its C2 server to activate these capabilities as required. Its persistent C2 communication and watchdog mechanisms help maintain long-term remote access.

Persistence:

The malware establishes persistence through two Windows Registry Run keys. It creates an Open Roaming entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches jbootstrap.exe automatically when the user logs into Windows.

A second Run key, Open Roaming Recovery, invokes recovery.vbs via wscript.exe. If jbootstrap.exe is missing, the script restores it, along with payload.jar and agent.json, from backup directories and silently relaunches it.

Scheduled Watchdog:

The Windows Script Host (wscript.exe) was used to execute watchdog.vbs from the C:\Users\Public\Documents\OpenRoaming\pkg\ directory. The Task Scheduler runs it every minute.

Once triggered, watchdog.vbs checks for three marker files (supervisor.stop, watchdog.disarm, state\persist.off) and exits immediately if any are found, a likely kill switch for the operator. It then queries running processes via WMI to check if the malware is already active. If jbootstrap.exe is missing, it restores jbootstrap.exe, payload.jar, and agent.json from backup directories and silently relaunches it.

C2 Communication and Remote Control:

The log shows the agent maintaining persistence through OpenRoaming.vbs and repeatedly communicating with the remote server through heartbeat and command-polling requests. It also starts a watchdog to monitor the process and keep it running.

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: JavaRat.A (Trojan)

 This file is detected by SonicWall Capture ATP w/RTDMI and SonicWall Endpoint Security.

Conclusion:

The analysis shows that the Rust executable acts primarily as a loader and persistence component rather than the primary RAT implementation. It embeds a Java payload, retrieves a dedicated Temurin Java runtime, extracts and executes the JAR, and establishes multiple persistence and recovery mechanisms. The Java payload then provides the remote-access functionality and communicates with the configured C2 infrastructure.

Indicators Of Compromise:

• 5635b3701aed2df80580b68843ff5f7309192ff01d54920e1dd2bfc6bb275100    - Rust Binary
• 49eca1b6171d860bb962d27426606af2784da0a7e628a64105501a9b12041d5d - payload.jar