Static

static

10

Resubmissions

07-07-2023 09:59

230707-lz275sgc54 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14052163e50c197697c64b1431b42271.exe

  • Size

    17.6MB

  • MD5

    14052163e50c197697c64b1431b42271

  • SHA1

    df301332faa73c3d5f915fde61df2fc9de21a61a

  • SHA256

    4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

  • SHA512

    124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab

  • SSDEEP

    393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg

Score
10/10
strrat

Malware Config

Extracted

Family

strrat

C2

rar.ydns.eu:9999

svchost.ydns.eu:10000
Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    false

  • startup

    true

Signatures

  • Strrat family
    strrat
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 14052163e50c197697c64b1431b42271.exe
    .exe windows:4 windows x86 arch:x86

    ab6770b0a8635b9d92a5838920cfe770


    Headers

    Imports

    Sections

  • Antimalware Service Executable.JS
    .js
  • EmbraTor Mac Smash Bullet.exe
    .exe windows:4 windows x86 arch:x86

    69feb6dca1ec711d7de42e65460068ac


    Headers

    Imports

    Sections

  • Java Install.jar
    .jar
  • MsMpEng.js
    .js
  • Windows Driver Foundation.vbs
    .vbs