Overview

overview

10

Static

static

1

Pago.jar

windows7-x64

10

Pago.jar

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Pago.jar

  • Size

    70KB

  • Sample

    230531-j3aaeseb5t

  • MD5

    6e6fb26ff6028ce18e7fb2956c9f934a

  • SHA1

    8671bbe30e60569d8089323ceadad83088db0eb2

  • SHA256

    2827cf7e0e7863202288f9735cfadde1dff2e6b271ba3ce50080a5b32cd97261

  • SHA512

    cb09f7938571045395912112a87377a5c6de351fa7e75acdc651e4cb4a420cd25076b71f0442c05d777a3d9c34189040eaa5a8f709c2449567fa3c0aa27228f8

  • SSDEEP

    1536:EDEJ5JDLCStQ5yc38E5a3Ptb7Ex+2e9ct5UNPJVvZ129UpmePF:lPDLUP38E5YPtbieIKLpkUkwF

Score
10/10
strratpersistencestealertrojan

Malware Config

Targets

    • Target

      Pago.jar

    • Size

      70KB

    • MD5

      6e6fb26ff6028ce18e7fb2956c9f934a

    • SHA1

      8671bbe30e60569d8089323ceadad83088db0eb2

    • SHA256

      2827cf7e0e7863202288f9735cfadde1dff2e6b271ba3ce50080a5b32cd97261

    • SHA512

      cb09f7938571045395912112a87377a5c6de351fa7e75acdc651e4cb4a420cd25076b71f0442c05d777a3d9c34189040eaa5a8f709c2449567fa3c0aa27228f8

    • SSDEEP

      1536:EDEJ5JDLCStQ5yc38E5a3Ptb7Ex+2e9ct5UNPJVvZ129UpmePF:lPDLUP38E5YPtbieIKLpkUkwF

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks