strrat | 4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709 | Triage

Sharing

General

Target

4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709.js
Size

857KB
Sample

240529-bse4xsde55
MD5

edaaa3cafcede4a37ebd20a66186a1d6
SHA1

7013756895e02f1b05262aae29bbb95880ec683f
SHA256

4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709
SHA512

bf42d14e1d3fe81dac16650490246aa3e6fd60bba25b77e8740e890643e99de645a84b6dae4095622022074969ab4c5532b233ff184b30b42d2e7546765d775b
SSDEEP

6144:XQ9qyW7HvTqAaoSW6KaUOAhTPhmyfoWhqfoFPBwgoTXGdSj7lJq/mpt5eWIQNy1d:go

Score

10^/10

strrat discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709.js
- Size
  
  857KB
- MD5
  
  edaaa3cafcede4a37ebd20a66186a1d6
- SHA1
  
  7013756895e02f1b05262aae29bbb95880ec683f
- SHA256
  
  4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709
- SHA512
  
  bf42d14e1d3fe81dac16650490246aa3e6fd60bba25b77e8740e890643e99de645a84b6dae4095622022074969ab4c5532b233ff184b30b42d2e7546765d775b
- SSDEEP
  
  6144:XQ9qyW7HvTqAaoSW6KaUOAhTPhmyfoWhqfoFPBwgoTXGdSj7lJq/mpt5eWIQNy1d:go
Score

10^/10

execution strrat discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratdiscoveryexecutionpersistencestealertrojan