strrat | 14052163e50c197697c64b143[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
14052163e50c197697c64b143.exe
Size 17.6MB
Sample240409-qvlrtabe9s
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat

Malware Config

Extracted

Family

strrat

rar.ydns.eu:9999
svchost.ydns.eu:10000

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
false
secondary_startup
false
startup
true

Signatures

Strrat family
strrat

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
14052163e50c197697c64b143.exe
unpack001/EmbraTor Mac Smash Bullet.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

14052163e50c197697c64b143.exe

.exe 17.6MB
Antimalware Service Executable.JS

.js 713KB
EmbraTor Mac Smash Bullet.exe

.exe 1012KB
Java Install.jar

.jar 92KB
MsMpEng.js

.js 24.2MB
Windows Driver Foundation.vbs

.vbs 984B

14052163e50c197697c64b143.exe

IMPHASH ab6770b0a8635b9d92a5838920cfe770
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA CreateDirectoryA lstrcmpiA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject ExitProcess GetWindowsDirectoryA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

EmbraTor Mac Smash Bullet.exe

IMPHASH 69feb6dca1ec711d7de42e65460068ac
SHA256 3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d
MD5 5d57e6b8aff1ec900f553789f6796648
SHA1 f9a953cfe6decb237ed98c30faabec8654d99171
SHA512 d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915
SSDEEP 12288:GgOVcYdHbAQkn+DXp79oN/LrveBU2vvFk/hHVEStxJX:GgOnDXToN/LreBU2vvaNtz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

16640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaFreeVar __vbaGosubReturn ord588 __vbaLateIdCall __vbaStrVarMove __vbaLenBstr __vbaLineInputStr __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaI2Abs __vbaCopyBytes __vbaStrCat __vbaVarCmpNe ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaVarTstLe __vbaAryDestruct __vbaLateMemSt __vbaExitProc __vbaVarForInit __vbaI4Abs __vbaOnError __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad __vbaBoolVar ord520 __vbaBoolVarNull __vbaFpR8 __vbaRefVarAry __vbaVarTstLt _CIsin __vbaVargVarMove ord632 __vbaChkstk __vbaGosubFree ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaR4Str __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarOr __vbaCastObjVar _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 __vbaGosub ord714 __vbaVarDiv __vbaI2Str ord608 ord531 ord716 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaUbound __vbaVarCat __vbaDateVar ord535 __vbaI2Var ord537 ord538 ord645 _CIlog ord539 __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaR8Str __vbaInStr ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy ord681 __vbaI4Str __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord616 __vbaVarCopy __vbaFpI4 ord617 _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaStrVarCopy ord619 _allmul __vbaLateIdSt _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

14052163e50c197697c64b143.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

Antimalware Service Executable.JS

EmbraTor Mac Smash Bullet.exe

msvbvm60

generic

Java Install.jar

MsMpEng.js

Windows Driver Foundation.vbs