strrat

Sharing

Copy URL Twitter E-mail

General

Target
14052163e50c197697c64b143.exe
Size 17.6MB
Sample240409-qvlrtabe9s
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

strrat

rar.ydns.eu:9999
svchost.ydns.eu:10000

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
false
secondary_startup
false
startup
true

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://files.catbox.moe/fvl5hy.jpg

Targets

- Target
  14052163e50c197697c64b143.exe
- Size 17.6MB
- SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
- MD5 14052163e50c197697c64b1431b42271
- SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
- SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
- SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

strrat xmrig evasion miner persistence stealer trojan discovery
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  Antimalware Service Executable.JS
- Size 713KB
- SHA256 e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf
- MD5 c958a31d5e439d5b0d01900e5a85992a
- SHA1 fc40d0ef637fe55fbaf83e8f4891e008ac736df6
- SHA512 2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c
- SSDEEP 12288:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBO0Xzaj1B+UquKbLZaQlx+2CRQlD+EhajH:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBc
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  EmbraTor Mac Smash Bullet.exe
- Size 1012KB
- SHA256 3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d
- MD5 5d57e6b8aff1ec900f553789f6796648
- SHA1 f9a953cfe6decb237ed98c30faabec8654d99171
- SHA512 d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915
- SSDEEP 12288:GgOVcYdHbAQkn+DXp79oN/LrveBU2vvFk/hHVEStxJX:GgOnDXToN/LreBU2vvaNtz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  Java Install.jar
- Size 92KB
- SHA256 16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284
- MD5 c55f9247eb8ea19af96292f0893f86b5
- SHA1 bd5e6884b8151114af7e45a92525893f4d2aaabd
- SHA512 3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb
- SSDEEP 1536:QL/61A/qP1+9Qc1+jxjciQnGSzPsRBo0fpL9mjMT8mMhe3gnHGvPvxKpjHr9Uy:QLn/qP1CQpjEGyP0Bxf99mYTX3gmvKLn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

strrat discovery stealer trojan persistence
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  MsMpEng.js
- Size 24.2MB
- SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
- MD5 690d57b0d8670391bad0876cae078bab
- SHA1 32bea01d606128c606b71e19920099c6cb15030f
- SHA512 dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4
- SSDEEP 49152:34aSO/UYGzBMZ09d1X5EdS76+B0RX8DQQs8ReDlpgU3HApVeOGMmb5cUNWcGTRPk:H
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig evasion miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  Windows Driver Foundation.vbs
- Size 984B
- SHA256 2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c
- MD5 df00d1e54f85ae90f2f69b73a34c90f4
- SHA1 1d3e521a8efc17334f4f578432d5af0bb1ef1951
- SHA512 5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618
- MD5 SHA1 SHA512
Score

10^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22 behavioral23 behavioral24

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner payload

Blocklisted process makes network request

Checks BIOS information in registry

Checks computer location settings

Drops startup file

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

STRRAT

Loads dropped DLL

Modifies file permissions

Adds Run key to start application

xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner payload

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

AutoIT Executable

Suspicious use of SetThreadContext

Blocklisted process makes network request

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24