Overview

overview

10

Static

static

1

Tax Return...765.js

windows7-x64

3

Tax Return...765.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Tax Returns Of R48,765.js

  • Size

    847KB

  • Sample

    240529-jptf5sff3w

  • MD5

    df72b6093c6815d39358aacea690f07a

  • SHA1

    63ee37b0cd1b4dc3855b94c6a6f5805bd86388fb

  • SHA256

    ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2

  • SHA512

    cbadc902a129e862262f2d9d0fdf108fe6267097de9d2f0539df293025a815294346e514d62655defc97d8b856027336255a883b018793a9b33c598644b45324

  • SSDEEP

    6144:XQTEI4vwybyl9DK/LiuM0bwucacoS1tGDKMnMcoeNFVZiMeDPtKefB3EenWDiM12:gZ

Score
10/10
strratdiscoveryexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      Tax Returns Of R48,765.js

    • Size

      847KB

    • MD5

      df72b6093c6815d39358aacea690f07a

    • SHA1

      63ee37b0cd1b4dc3855b94c6a6f5805bd86388fb

    • SHA256

      ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2

    • SHA512

      cbadc902a129e862262f2d9d0fdf108fe6267097de9d2f0539df293025a815294346e514d62655defc97d8b856027336255a883b018793a9b33c598644b45324

    • SSDEEP

      6144:XQTEI4vwybyl9DK/LiuM0bwucacoS1tGDKMnMcoeNFVZiMeDPtKefB3EenWDiM12:gZ

    Score
    10/10
    executionstrratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks