General
-
Target
42231b94c22a47f49e781e88f0045578d201139371cc98e346bf1b0aec6ed61a.jar
-
Size
177KB
-
MD5
2186c6177bdcc081ce0e58c179bfe378
-
SHA1
34292963fb2a4ca706e248447cbd8e4f6505c3d0
-
SHA256
42231b94c22a47f49e781e88f0045578d201139371cc98e346bf1b0aec6ed61a
-
SHA512
74795e98f12ac55af71092236eb74db59d80416785bd51ec8da62f414615e1fd615fa138bf8d0f1fe303449e3e77537c897e09ad91f7e7174a2d91b5e91fc73a
-
SSDEEP
3072:Zv7ak/MnWMpxBO2V2LdD1cHHkzOLx9QBznk7VPyXVd7lVARUmcozx:5//Mr/MdD1wHTkzk7Vqld6So9
Score
10/10
Malware Config
Extracted
Family
strrat
C2
173.254.204.77:8123
Attributes
-
license_id
AM80-916G-ZKQ1-G50E-OAMF
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
-
Detects PowerShell content designed to retrieve passwords from host 1 IoCs
-
Strrat family
Files
-
42231b94c22a47f49e781e88f0045578d201139371cc98e346bf1b0aec6ed61a.jar