Overview

overview

10

Static

static

1

5595c1dc3d...cc.jar

windows7-x64

1

5595c1dc3d...cc.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar

  • Size

    481KB

  • Sample

    240612-bvfs8sxfmb

  • MD5

    11dec5e1d8b13456cd7e0ccb966fe12c

  • SHA1

    0c5ea4abbafa47010d529b2736a54b09da4cad29

  • SHA256

    5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc

  • SHA512

    a397c58ea60d12a45b295d8a7e85f3d5973ce836c9df97f7b5194020e6043a62d74cf2d521d1ff2d523dc0d60b0eb1f648a08ccfc7bc83b4fa1b769528da638a

  • SSDEEP

    12288:SVlCHKeQSPE4dP/I5FsRb5h3pCy1tEARGuJKcc:SHCHlrnIYxo0Gu4

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar

    • Size

      481KB

    • MD5

      11dec5e1d8b13456cd7e0ccb966fe12c

    • SHA1

      0c5ea4abbafa47010d529b2736a54b09da4cad29

    • SHA256

      5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc

    • SHA512

      a397c58ea60d12a45b295d8a7e85f3d5973ce836c9df97f7b5194020e6043a62d74cf2d521d1ff2d523dc0d60b0eb1f648a08ccfc7bc83b4fa1b769528da638a

    • SSDEEP

      12288:SVlCHKeQSPE4dP/I5FsRb5h3pCy1tEARGuJKcc:SHCHlrnIYxo0Gu4

    Score
    10/10
    strratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks