Overview

overview

10

Static

static

10

SB COPY682...DF.jar

windows7-x64

10

SB COPY682...DF.jar

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SB COPY6827366180.PDF.zip
  • Size 38KB
  • Sample240201-em5deaaha4
  • SHA256 de1522a546abbff8b5cdde813b89e754ab0da6894e25bba0243a7a79e26a99d5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

  • strrat

C2

  • 2024logs.freetcp.com:8082

Attributes
  • license_id

    RKA0-KES0-EPPK-UDRO-JNCG

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target
      SB COPY6827366180.PDF.jar
    • Size 40KB
    • SHA256 243a5315c031347617620bb5c8b694b3308932530519abc04e00c7c4fd7f7c62
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    strratpersistencestealertrojandiscovery

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks