strrat | f258e1a04ad4cc71b7dd2c4f88b7534c0ca5f15163d6c76dfdb3a82a5d1abf02 | Triage

Sharing

General

Target

f258e1a04ad4cc71b7dd2c4f88b7534c0ca5f15163d6c76dfdb3a82a5d1abf02.js
Size

776KB
Sample

240601-wp6gxsad9s
MD5

1d26836dd11e3edf4982cac936614871
SHA1

6a1d15f15eea691da47b0a2b0a326fea2be3539d
SHA256

f258e1a04ad4cc71b7dd2c4f88b7534c0ca5f15163d6c76dfdb3a82a5d1abf02
SHA512

1371926913b860c5c798080c0c4563ec92b9555495e0d1f629cd536cb432fc9cf97a12c2e8c467e7a845daafe91ef30a223b65841059edcf5c9786ffb0cb37f4
SSDEEP

6144:XQzJeftRXJpA2OEL42YdLHmaNFq5fC1il2gzLKDvlQCxhGgmRR7L/xrE6AUbDlc3:g/

Score

10^/10

strrat discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  f258e1a04ad4cc71b7dd2c4f88b7534c0ca5f15163d6c76dfdb3a82a5d1abf02.js
- Size
  
  776KB
- MD5
  
  1d26836dd11e3edf4982cac936614871
- SHA1
  
  6a1d15f15eea691da47b0a2b0a326fea2be3539d
- SHA256
  
  f258e1a04ad4cc71b7dd2c4f88b7534c0ca5f15163d6c76dfdb3a82a5d1abf02
- SHA512
  
  1371926913b860c5c798080c0c4563ec92b9555495e0d1f629cd536cb432fc9cf97a12c2e8c467e7a845daafe91ef30a223b65841059edcf5c9786ffb0cb37f4
- SSDEEP
  
  6144:XQzJeftRXJpA2OEL42YdLHmaNFq5fC1il2gzLKDvlQCxhGgmRR7L/xrE6AUbDlc3:g/
Score

10^/10

execution strrat discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratdiscoveryexecutionpersistencestealertrojan