Overview

overview

10

Static

static

POM9433T-V...ip.jar

windows7_x64

10

POM9433T-V...ip.jar

windows10_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    POM9433T-V_16-04-2021_pdf.zip.jar

  • Size

    181KB

  • Sample

    210416-kmj8kjffyj

  • MD5

    3fbb39fa80df151835c3cd611800851a

  • SHA1

    469b410c2c2637ecb6f9121bd6433ec5db77f42a

  • SHA256

    63d009b50ac6f3eeaf0890cf605993c2a7031fac53dd7225049fa2934520b937

  • SHA512

    79a90a7a476eca64ff2ebe05d0188580a751577bb739de62ddebf682363b1947e16222ed374ea0afa17db6aec65fb488830b0d121a83a31cb131c4fd4b9af4ec

Score
10/10
strratpersistencestealertrojan

Malware Config

Targets

    • Target

      POM9433T-V_16-04-2021_pdf.zip.jar

    • Size

      181KB

    • MD5

      3fbb39fa80df151835c3cd611800851a

    • SHA1

      469b410c2c2637ecb6f9121bd6433ec5db77f42a

    • SHA256

      63d009b50ac6f3eeaf0890cf605993c2a7031fac53dd7225049fa2934520b937

    • SHA512

      79a90a7a476eca64ff2ebe05d0188580a751577bb739de62ddebf682363b1947e16222ed374ea0afa17db6aec65fb488830b0d121a83a31cb131c4fd4b9af4ec

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks