General

  • Target

    5399fb6e453415e22574998ee5b44242.bin

  • Size

    212KB

  • MD5

    01b41ec0bd6da387ba328d10e737a034

  • SHA1

    45811cbf54c433ff894930c22b6d24a28cc76a74

  • SHA256

    a7832561986756fa26f3ae23491ef52334d692e9e5460a162a42401b8e425b6e

  • SHA512

    370475c5ed2b3e0a090e865f68f2d5e3ccf26d901d810b9bb86aeaccdfb2df5eadb8963a9921d7d42007d4a6cb7c5929e89d6c605506e5fb18e59388cd55d9b6

  • SSDEEP

    3072:WEm4crR8weXv+Q7oKGo7WuYK6wNJ8gik31/auFVrW2VeYg/QPqBakGkkeshDAhTQ:C4crivbMSx6wNJ/Hl/T/rGYHS4HhDB

Score
10/10

Malware Config

Extracted

Family

strrat

C2

172.93.181.218:8980

127.0.0.1:8980

Attributes
  • license_id

    FX7Y-S8H4-DZOR-QUCL-K55Z

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Signatures

Files

  • 5399fb6e453415e22574998ee5b44242.bin
    .zip

    Password: infected

  • 33ede71b4b1c854c3af8d035947a1cb0e8bd6eefcca74eb17f42fdf002e0b856.jar
    .jar