General

  • Target

    b03ff6dddff5ea21a129890deab5a9cdbin_JC.zip

  • Size

    211KB

  • Sample

    230917-llejxsha7v

  • MD5

    e0af85be2ff6e8e572abe1d5adb32f56

  • SHA1

    fd64bdebfad726679113e4fb8283ca5a9a8184e9

  • SHA256

    5e0de5fe9f089b2a786a9c88781c98edccd09ee4a25ddbf5290ef4baff2a049c

  • SHA512

    63269a4192ded12d18731892511addbb1b3cef06dfb9ae6b3f24324e9430ac6900542ed71c14bbf0d8ac6c275d85e45753c59ef8e94eefbb6804ead8b94c2148

  • SSDEEP

    3072:IRHT6WW2/l2YR1ojetltJ3Vz+gllin7SfVgJpv3BcFfV3hncu2rSJb1bQ8:cHT6WTtmje5z+wUOfVgrxcvR8obQ8

Malware Config

Extracted

Family

strrat

C2

bmh-global.myfirewall.org:1414

Attributes
  • license_id

    NMW9-U4JI-9LTC-U9WX-QZTF

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      4e01f52192ab0212716a2ac06c4e2eb539b93c3fc08fa429aacc7e683d74b061.jar

    • Size

      218KB

    • MD5

      b03ff6dddff5ea21a129890deab5a9cd

    • SHA1

      89dec8305668280d967a7caeba81b87b0c43926f

    • SHA256

      4e01f52192ab0212716a2ac06c4e2eb539b93c3fc08fa429aacc7e683d74b061

    • SHA512

      7c9c3284bf43366fefb4ba94b6d58eb119427aeebfccb7d47942ff168e711c81887df3d7d29ce542e2134887d7e664612b0c8a8c1e94c3a895d4738563203f4c

    • SSDEEP

      6144:gyepr4uHxtA/7jOhXWnzqRv9TPvLXd6IH2x:KbLACRPFZ6aI

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks