e2e7bb79269c7b3367b4ea7f96587a9bfc501d88b446181d13070788ba9bf543

Analysis

Target
394-20200707-10-STRONGAS.jar
Size 426KB
Sample200709-xa6lb6exce
SHA256 e2e7bb79269c7b3367b4ea7f96587a9bfc501d88b446181d13070788ba9bf543
MD5 f7d2e3baf446952c84c783d8dcb4ffb8
SHA1 ed5ae96da0f0a2a7f5ec6bd76de124b494f6f09f
SHA512 e7f34108476bd26e45aa88574e69922ddb5a83b6149a69b513b8321f739bae330665f737bd5702d4a16878eed86903e641535ed86f47c5d3f9818e933c4f8d44
MD5 SHA1 SHA512

Score

7^/10

spyware

Loads dropped DLL 2 IoCs

pid	Process
4092	java.exe
4092	java.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	bot.whatismyipaddress.com

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\394-20200707-10-STRONGAS.jar
1⤵
- Loads dropped DLL
PID:4092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact