strrat | 201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea | Triage

Sharing

General

Target

201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea.js
Size

415KB
Sample

240619-snvr9axcpm
MD5

b7bef63b1d36f38f696469ace03c61c4
SHA1

6354ac040b6fda031ebf37e90eae9eb68b97bd94
SHA256

201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea
SHA512

a94833b8df108d34f39c87377ab0f46a81774056e40e45f34e504c25ed7e99e647a4622b30be7096e526e1a359a69c99261f69805cc7e956d8bc4f865a3ffd45
SSDEEP

6144:XQ6gcED4sXas+CryilhnTUX5jcniqlSu+yxq3RKN24mR1V3JMV9DLC7:g688sXasSsUXiXEwgLcLC7

Score

10^/10

strrat collection discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea.js
- Size
  
  415KB
- MD5
  
  b7bef63b1d36f38f696469ace03c61c4
- SHA1
  
  6354ac040b6fda031ebf37e90eae9eb68b97bd94
- SHA256
  
  201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea
- SHA512
  
  a94833b8df108d34f39c87377ab0f46a81774056e40e45f34e504c25ed7e99e647a4622b30be7096e526e1a359a69c99261f69805cc7e956d8bc4f865a3ffd45
- SSDEEP
  
  6144:XQ6gcED4sXas+CryilhnTUX5jcniqlSu+yxq3RKN24mR1V3JMV9DLC7:g688sXasSsUXiXEwgLcLC7
Score

10^/10

execution strrat collection discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratcollectiondiscoveryexecutionpersistencestealertrojan