Overview

overview

10

Static

static

10

Prosba-o-oferte.jar

windows7-x64

10

Prosba-o-oferte.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Prosba-o-oferte.jar

  • Size

    41KB

  • Sample

    240305-ntkf9adh3z

  • MD5

    b225f83a537673f3053e63db84a30662

  • SHA1

    55ea9f056d46bdd03a78df3e885565ec845a31c1

  • SHA256

    7c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764

  • SHA512

    f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523

  • SSDEEP

    768:3/AKKv6LboyiFV9jKJ6K71Ifu+Lh+FP+6I3zY103e0NhyDEj:YJvIaV9LqCush+FPKs10ufDE

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

elastsolek21.duckdns.org:4781

zekeriyasolek45.duckdns.org:4781
Attributes
  • license_id

    WFC9-W4KB-388F-9KY1-S6JV

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      Prosba-o-oferte.jar

    • Size

      41KB

    • MD5

      b225f83a537673f3053e63db84a30662

    • SHA1

      55ea9f056d46bdd03a78df3e885565ec845a31c1

    • SHA256

      7c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764

    • SHA512

      f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523

    • SSDEEP

      768:3/AKKv6LboyiFV9jKJ6K71Ifu+Lh+FP+6I3zY103e0NhyDEj:YJvIaV9LqCush+FPKs10ufDE

    Score
    10/10
    strratpersistencestealertrojandiscovery

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks