strrat | ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2 | Triage

Sharing

General

Target

ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2.js
Size

847KB
Sample

240530-b1ztasag83
MD5

df72b6093c6815d39358aacea690f07a
SHA1

63ee37b0cd1b4dc3855b94c6a6f5805bd86388fb
SHA256

ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2
SHA512

cbadc902a129e862262f2d9d0fdf108fe6267097de9d2f0539df293025a815294346e514d62655defc97d8b856027336255a883b018793a9b33c598644b45324
SSDEEP

6144:XQTEI4vwybyl9DK/LiuM0bwucacoS1tGDKMnMcoeNFVZiMeDPtKefB3EenWDiM12:gZ

Score

10^/10

strrat discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2.js
- Size
  
  847KB
- MD5
  
  df72b6093c6815d39358aacea690f07a
- SHA1
  
  63ee37b0cd1b4dc3855b94c6a6f5805bd86388fb
- SHA256
  
  ed0b6130808ed7feb630ab33d8ab2bc27d2292a418eb9e0da253be96182282f2
- SHA512
  
  cbadc902a129e862262f2d9d0fdf108fe6267097de9d2f0539df293025a815294346e514d62655defc97d8b856027336255a883b018793a9b33c598644b45324
- SSDEEP
  
  6144:XQTEI4vwybyl9DK/LiuM0bwucacoS1tGDKMnMcoeNFVZiMeDPtKefB3EenWDiM12:gZ
Score

10^/10

execution strrat discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratdiscoveryexecutionpersistencestealertrojan