General

  • Target

    147056ef41389a1f59ba0ff32ddde8b7.bin

  • Size

    66KB

  • Sample

    231128-bq2vxaec5y

  • MD5

    6f080e0ead955a40ff2608c7d353a6eb

  • SHA1

    0c2e8bedc8233187106070eddcc433730a7bc12d

  • SHA256

    ffcd43f1adc589ea49975b3782f0815d22cea28785c8959dee6a1e63360fae98

  • SHA512

    72b0b33521a65192d2f01d5b564d0f2391ab830ea382c1dfeef27c4861800d43de1c64cc54523b8814b6745b4568bb393c9952071f7c0a1e058d57966248dcce

  • SSDEEP

    1536:WKtKTbSpltzNplMv8S7v261xNFrv2VW7aKNjsu2Ac55zYvIWRuFQt:5IbSPtz2tbTOVW7aKVsr35zYwWj

Malware Config

Extracted

Family

strrat

C2

binacafe.duckdns.org:6586

127.0.0.1:6586

Attributes
  • license_id

    ON0K-D4YD-8WHU-SHV5-GE8B

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234.jar

    • Size

      67KB

    • MD5

      147056ef41389a1f59ba0ff32ddde8b7

    • SHA1

      34d1f67a5a10afb224b8b5e06363a6e44ac5ee3b

    • SHA256

      0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234

    • SHA512

      98c6f0b355c2392fcdf2ed6368b1fef249cf53bdd492517914d35b6a7049b161e235accdc919e77718a57107a4383174fb6cadc2d53b2a03f2f94f74486632db

    • SSDEEP

      768:ewL3z9DFCYOW9HfcmZmV93KKr8K/dC3cfKYRsOanopEt3OfoAiVK/f7SWPs+D5le:n7RQYF9Ume3K7KNdEGoNVKnb5z5s6oH

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

    • Drops startup file

    • Modifies file permissions

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks