Overview

overview

10

Static

static

1

e6e7a19513...74.jar

windows7-x64

1

e6e7a19513...74.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e6e7a195132e49584dd2015d1dcb43e547cd55c1a772f3509b126fdc555a8374.jar

  • Size

    558KB

  • Sample

    240522-c1vd9ahg21

  • MD5

    bcba7d102e446ddc938ac77dc6839957

  • SHA1

    cfec4feb6928e64b4f687b251226fea8ed711272

  • SHA256

    e6e7a195132e49584dd2015d1dcb43e547cd55c1a772f3509b126fdc555a8374

  • SHA512

    413e11469477db47ae5e9cda764fe03bb03ce0c5589f92dd71b55078ed118f3f02cecc9d047142233c239ffd7c6ba44c5ac3c4337046e05311e9d4ff17a0fa57

  • SSDEEP

    12288:TEeO4P145DUpuLHpDK5j+gXAhfpJEFqwM:TEept4mpuFaq/hb

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      e6e7a195132e49584dd2015d1dcb43e547cd55c1a772f3509b126fdc555a8374.jar

    • Size

      558KB

    • MD5

      bcba7d102e446ddc938ac77dc6839957

    • SHA1

      cfec4feb6928e64b4f687b251226fea8ed711272

    • SHA256

      e6e7a195132e49584dd2015d1dcb43e547cd55c1a772f3509b126fdc555a8374

    • SHA512

      413e11469477db47ae5e9cda764fe03bb03ce0c5589f92dd71b55078ed118f3f02cecc9d047142233c239ffd7c6ba44c5ac3c4337046e05311e9d4ff17a0fa57

    • SSDEEP

      12288:TEeO4P145DUpuLHpDK5j+gXAhfpJEFqwM:TEept4mpuFaq/hb

    Score
    10/10
    strratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks