0

I dumbly downloaded a .jar file that contained jRAT. When run, it stalls, gives a FileNotFoundException, then crashes. When I ls'd, the jar was there. When I cd'd out and back in, the jar was gone.

I'm running Debian Wheezy, and GNOME. Now there is a white block thing in the panel, and when hovering over it it says jRAT. Here's the block:

white blocky thingie in panel

Here's me hovering over it:

enter image description here

3 questions:

  1. How do I get rid of this?
  2. How did it remove itself?
  3. How can I remove the annoying white blocky thing?
Improve this question

1 Answer 1

Reset to default
0

  1. There's apparently a remover hosted by the author of jRAT at https://github.com/redpois0n/. I recommend reading the sources and cleaning up yourself rather than running untrusted code though :-)

  2. No idea. It could be that it redefined your ls function, but you would normally require a reload of the environment to have the new ls taken into account. Was that thing installed as root? How exactly did you cd back in? With a new terminal? Are you sure it didn't just delete itself and your timing was just a coincidence?

  3. Isn't this the same question as 1? In any case you can identify the running process, it should have a socket or a D-Bus connection (or a pipe or shm segment or any other IPC handle) open with your desktop environment's panel. Find out how your panel handles systray notifications and then figure out how to find if a process uses the systray. Then you can happily parse /proc to find the culprits! (and some possible alternative methods on this SE question)

Improve this answer
7
  • Ensure you clean .profile, .bash_rc, your XDG autostart directory, whatever files you have that define the XDG session you run (not sure where these are located).
    – Steve Dodier-Lazaro
    Commented Oct 14, 2014 at 0:02
  • Reply to No. 2: All in the same terminal. And it was run by me (not root).
    – Spotlight
    Commented Oct 14, 2014 at 1:05
  • I would go with coincidental deleting then, at least until I can get hold of some code to read.
    – Steve Dodier-Lazaro
    Commented Oct 14, 2014 at 11:48
  • It hid itself in my Documents folder as .com.apple.mobilesecurity.Bonjour.jar,jar. Tricky thing, considering that I deal with Apple stuff alot. Thank you!
    – Spotlight
    Commented Oct 14, 2014 at 12:58
  • I would not assume that the code "knows" you would be unlikelier to delete Bonjour than another user. Rather, Bonjour has a legitimate reason to be run on any platform. Don't you have access to the code in the jar? If you do you could (maybe?) check what else you need to clean up.
    – Steve Dodier-Lazaro
    Commented Oct 14, 2014 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .