Overview

overview

10

Static

static

10

overdues-pdf.jar

windows7-x64

10

overdues-pdf.jar

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    overdues-pdf.jar

  • Size

    67KB

  • Sample

    231126-wzw18sah52

  • MD5

    147056ef41389a1f59ba0ff32ddde8b7

  • SHA1

    34d1f67a5a10afb224b8b5e06363a6e44ac5ee3b

  • SHA256

    0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234

  • SHA512

    98c6f0b355c2392fcdf2ed6368b1fef249cf53bdd492517914d35b6a7049b161e235accdc919e77718a57107a4383174fb6cadc2d53b2a03f2f94f74486632db

  • SSDEEP

    768:ewL3z9DFCYOW9HfcmZmV93KKr8K/dC3cfKYRsOanopEt3OfoAiVK/f7SWPs+D5le:n7RQYF9Ume3K7KNdEGoNVKnb5z5s6oH

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

binacafe.duckdns.org:6586

127.0.0.1:6586
Attributes
  • license_id

    ON0K-D4YD-8WHU-SHV5-GE8B

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      overdues-pdf.jar

    • Size

      67KB

    • MD5

      147056ef41389a1f59ba0ff32ddde8b7

    • SHA1

      34d1f67a5a10afb224b8b5e06363a6e44ac5ee3b

    • SHA256

      0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234

    • SHA512

      98c6f0b355c2392fcdf2ed6368b1fef249cf53bdd492517914d35b6a7049b161e235accdc919e77718a57107a4383174fb6cadc2d53b2a03f2f94f74486632db

    • SSDEEP

      768:ewL3z9DFCYOW9HfcmZmV93KKr8K/dC3cfKYRsOanopEt3OfoAiVK/f7SWPs+D5le:n7RQYF9Ume3K7KNdEGoNVKnb5z5s6oH

    Score
    10/10
    strratpersistencestealertrojandiscovery

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks