Overview

overview

10

Static

static

PAYMENT_RE...44.jar

windows7_x64

10

PAYMENT_RE...44.jar

windows10_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    PAYMENT_RECEIPT_INV8938464944.zip
  • Size 354KB
  • Sample220512-vwlweshcaq
  • SHA256 65caf68cce79fa953e7fea1f7be0ee3e14104f23ea16c10560fb9af9617ce4eb
  • MD5 SHA1 SHA512
Score
10/10
strratpersistencestealersuricatatrojan

Malware Config

Targets

    • Target
      PAYMENT_RECEIPT_INV8938464944.jar
    • Size 1.4MB
    • SHA256 e3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0
    • MD5 SHA1 SHA512
    Score
    10/10
    strratpersistencestealersuricatatrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • suricata: ET MALWARE STRRAT CnC Checkin

      suricata: ET MALWARE STRRAT CnC Checkin

      suricata

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks