strrat | d5ed6717c6b756c1604c1182f078107148dbe72dac5112a6cf3e1b772699676b | Triage

Sharing

General

Target

d5ed6717c6b756c1604c1182f078107148dbe72dac5112a6cf3e1b772699676b.jar
Size

301KB
Sample

240509-ch6pkafb96
MD5

d4dd87e0ace13b1f69b1a6653d6cff4e
SHA1

8d25a40f4dabe65335214e7347671bc4de4a42a0
SHA256

d5ed6717c6b756c1604c1182f078107148dbe72dac5112a6cf3e1b772699676b
SHA512

22c5b257a23161802f1ed09a428b4402be334253bea2b71875ac6262cd8da3da2c62333a36879946ff15b5cd11b04a846589ac53be279b0817a49be4d98543bb
SSDEEP

6144:opxd3RUwD5ZvA8iX0TdbycfzVokKcU0x/zQOnZvLeGx1inwWH6H5cgGW:op/3RUqDYTkJ+cfzq3cb9z7LeE6U5cgH

Score

10^/10

strrat discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  d5ed6717c6b756c1604c1182f078107148dbe72dac5112a6cf3e1b772699676b.jar
- Size
  
  301KB
- MD5
  
  d4dd87e0ace13b1f69b1a6653d6cff4e
- SHA1
  
  8d25a40f4dabe65335214e7347671bc4de4a42a0
- SHA256
  
  d5ed6717c6b756c1604c1182f078107148dbe72dac5112a6cf3e1b772699676b
- SHA512
  
  22c5b257a23161802f1ed09a428b4402be334253bea2b71875ac6262cd8da3da2c62333a36879946ff15b5cd11b04a846589ac53be279b0817a49be4d98543bb
- SSDEEP
  
  6144:opxd3RUwD5ZvA8iX0TdbycfzVokKcU0x/zQOnZvLeGx1inwWH6H5cgGW:op/3RUqDYTkJ+cfzq3cb9z7LeE6U5cgH
Score

10^/10

execution strrat discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratdiscoveryexecutionpersistencestealertrojan