Overview

overview

10

Static

static

1

4ed0b23797...709.js

windows7-x64

3

4ed0b23797...709.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edaaa3cafcede4a37ebd20a66186a1d6.bin

  • Size

    169KB

  • Sample

    240530-dyyvbscg2s

  • MD5

    52fedfea42dc1e481dc2b1cef24e6278

  • SHA1

    800c900fcb5a9112310929065c892e7f18eb335b

  • SHA256

    1359df7de9c3085c329bb751a5819d70a60b5bf8ee26f4d063b18295f3f48c00

  • SHA512

    20c291a0525e59be811d29bf4c47badb6bb5e6745fa8f0a117f1aef4ad0f69b774e6d03c2e18822f01284310b48f841792b90470b43baf5b4cdd2c0f7b679801

  • SSDEEP

    3072:fnRDwcXXyvZbBaeElrK04zvRC0VKupfMWSERmK/dWD/O68aJDvCqnvM:vRDxEVUNrKHjZVp0qzFWDm68KDvCq0

Score
10/10
strratdiscoveryexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709.js

    • Size

      857KB

    • MD5

      edaaa3cafcede4a37ebd20a66186a1d6

    • SHA1

      7013756895e02f1b05262aae29bbb95880ec683f

    • SHA256

      4ed0b23797cd71aaf3dd2ecb91211fffadad14b77c4f10812f2ce32e05b58709

    • SHA512

      bf42d14e1d3fe81dac16650490246aa3e6fd60bba25b77e8740e890643e99de645a84b6dae4095622022074969ab4c5532b233ff184b30b42d2e7546765d775b

    • SSDEEP

      6144:XQ9qyW7HvTqAaoSW6KaUOAhTPhmyfoWhqfoFPBwgoTXGdSj7lJq/mpt5eWIQNy1d:go

    Score
    10/10
    executionstrratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks