Overview

overview

10

Static

static

fattura.jar

windows7_x64

10

fattura.jar

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fattura.jar
  • Size 221KB
  • Sample200710-ybcpwfddrn
  • SHA256 be32a4b1ba9b1ac7803eac01ca4a38f96770ad27d2d434794809ba3242182b0d
  • MD5 SHA1 SHA512
Score
10/10
rattywshratpersistencerattrojan

Malware Config

Targets

    • Target
      fattura.jar
    • Size 221KB
    • SHA256 be32a4b1ba9b1ac7803eac01ca4a38f96770ad27d2d434794809ba3242182b0d
    • MD5 SHA1 SHA512
    Score
    10/10
    persistencetrojanwshratratratty

    • Ratty

      Ratty is an open source Java Remote Access Tool.

      trojanratratty

    • Ratty Rat Payload

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Blacklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks