Behind the Decoy, Inside a Modular Java Backdoor
Reverse engineering of a Windows-oriented Java backdoor ecosystem: a feature-rich MAIN implant (1.9.137) and a separate LITE implant (0.5.8) for maintaining access and switching back to MAIN.
Two-stage VBScript delivery displays a decoy PDF and stages a bundled Java runtime under a Microsoft-like AppData path. The launcher is renamed TextInputHost.exe, with logon persistence launching TextInputHost.jar. The implementation combines Java 25, obfuscated packages, embedded native DLLs and Windows API access through Java FFM.
| Area | Capabilities identified in the reviewed code |
|---|---|
| Remote control | Command and PowerShell execution; file transfer; filesystem, process and registry management; additional payload execution. |
| Desktop and surveillance | Remote desktop, RDP/HVNC interfaces, screen recording, clipboard control, microphone capture, live/offline keylogging and form grabbing. |
| Credential and session theft | Chromium/Firefox passwords, cookies, history, autofill and available payment data; Windows/RDP credentials; mail-client secrets; cloud tokens and credential files. |
| Browser interception | Native browser hooks, authentication/traffic capture, configurable web-injection and proxying through hooked browsers. |
| Local HTTPS interception | GhostBrowser proxy/MITM, certificate installation, PAC/QUIC changes, request/response modification and cookie correlation/replay. |
| Login deception and clipboard abuse | Counterfeit Windows login interface for password capture; cryptocurrency address replacement. |
| Reconnaissance and collection | Host/security-product inventory, document and secret discovery, mailbox content and contact relationships. |
| AI and extensions | DeepSeek-assisted analysis of collected material; C2-controlled MCP bundle deployment, tool discovery and invocation. |
| Pivoting and lateral execution | SOCKS, generic/RDP tunnels, WireGuard; interfaces for SMB/service execution, WMI, scheduled tasks, WinRM, DCOM, SSH, RDP and pass-the-hash. |
| Privilege and defense operations | Injection, token manipulation, UAC/elevation paths, LSASS/SAM/Kerberos collection, API unhooking and security-product impairment attempts. |
| Persistence and lifecycle | Run keys, scheduled-task paths, encrypted local state, signed updates, VBS reinstallation, anti-analysis/cleanup routines and transfer to LITE. |
- MAIN: Cloudflare Workers WSS relay, timestamp/HMAC authentication, layered AES-GCM transport, X25519 session-key exchange, plus separate DNS-over-HTTPS discovery/beacon code paths.
- LITE: CMD/PowerShell, disk-based download-and-execute, user-logon autorun, signed self-updates, transfer to MAIN and best-effort uninstall. Its separate WSS transport uses bearer authentication and X25519/AES-GCM; MAIN's static-key outer frame wrapper is absent.
- Verified linkage: the uploaded ZIP matches the dropper's pinned SHA-256. Three shared cryptographic/vault classes are byte-identical to retained MAIN classes, and the update signing public key matches.
- Operational details: initial LITE persistence follows key exchange; pre-exchange JSON does not require the application
ENCwrapper; returning to MAIN does not explicitly remove LITE autorun.
Capabilities above reflect reviewed implementations and interfaces, not proof of successful execution on a victim. Prerequisites, incomplete methods and unresolved native behavior are documented in the report. A bounded local MAIN transport test validated authentication and encryption handling; LITE was analyzed statically with authenticated vault decryption. No live C2 tasking was collected.
NeonVanguard is an analyst-assigned provisional name. The report does not establish a previously unknown family, a specific threat actor or a successful zero-day exploitation.