ThreatLabz

JanelaRAT is a Windows remote-access trojan analyzed in this report that actively monitors foreground window titles (using a downloadable kepler186f.txt list) to detect financially-relevant applications, captures screenshots, logs mouse and keyboard activity, supports remote desktop sessions, can block or close specified windows via block.blq, display fake modal dialogs to deceive users, and execute a range of attacker-controlled actions and modes; the sample examined was active at the time of analysis and includes explicit artifacts and behaviors enabling credential/data theft and persistent remote control.