Overview

overview

10

Static

static

1

cdddb72528...49.jar

windows7-x64

1

cdddb72528...49.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cdddb72528ea0f9535676df3b408ba6bf4a8bf8b7d6a0ed6f74950c5300ab049.jar

  • Size

    452KB

  • Sample

    240531-l462wseh44

  • MD5

    42fd31ecef528cdfadc0c2029acd4dd3

  • SHA1

    19712ae2e86368ee1bdad8bcad63bd0737f1ea29

  • SHA256

    cdddb72528ea0f9535676df3b408ba6bf4a8bf8b7d6a0ed6f74950c5300ab049

  • SHA512

    ad11734d8c8d325e326ad3e098931236780f2ea91910f0af538f17648a6ebc26e93b068f84eea254f55d992365526624a18006a6317bd2b8f41f1b01c493477f

  • SSDEEP

    12288:KU+rjFbxSTrH/MD8nAQaGroLs1zYJMhTQaQZbX6I:2jFbxurfOAqKoLslYJMhTQaMzl

Score
10/10
strratcollectiondiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      cdddb72528ea0f9535676df3b408ba6bf4a8bf8b7d6a0ed6f74950c5300ab049.jar

    • Size

      452KB

    • MD5

      42fd31ecef528cdfadc0c2029acd4dd3

    • SHA1

      19712ae2e86368ee1bdad8bcad63bd0737f1ea29

    • SHA256

      cdddb72528ea0f9535676df3b408ba6bf4a8bf8b7d6a0ed6f74950c5300ab049

    • SHA512

      ad11734d8c8d325e326ad3e098931236780f2ea91910f0af538f17648a6ebc26e93b068f84eea254f55d992365526624a18006a6317bd2b8f41f1b01c493477f

    • SSDEEP

      12288:KU+rjFbxSTrH/MD8nAQaGroLs1zYJMhTQaQZbX6I:2jFbxurfOAqKoLslYJMhTQaMzl

    Score
    10/10
    strratcollectiondiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks