strrat | 4f071d0dfe0d2e57c44b9157680ef8d17a36323095c212f3fb09faf59d8c91c1 | Triage

Sharing

General

Target

230f66e17bb2888242f14a2403d0c9a6_JaffaCakes118
Size

175KB
Sample

240703-t3139azfjc
MD5

230f66e17bb2888242f14a2403d0c9a6
SHA1

7482a6068d0562b8002bc1827d9b073012d389ba
SHA256

4f071d0dfe0d2e57c44b9157680ef8d17a36323095c212f3fb09faf59d8c91c1
SHA512

1a5b6028890ec40ea2b56840b6d96f724a853e085a5171f14758353f5909626df1459610ffe22565b8de71a28d8bae3b30c01d1c01d145f56997060e8b5c43db
SSDEEP

3072:mFe/oCh46wP4TEx46CG2Q8yIsKAE6tH0rzZcPU7rWIC0IegnEWetqaDtbQK:mFChxwQU4e29yIzAbRQSXSIextqaDtQK

Score

10^/10

strrat discovery execution persistence stealer trojan

Malware Config

Targets

- Target
  
  230f66e17bb2888242f14a2403d0c9a6_JaffaCakes118
- Size
  
  175KB
- MD5
  
  230f66e17bb2888242f14a2403d0c9a6
- SHA1
  
  7482a6068d0562b8002bc1827d9b073012d389ba
- SHA256
  
  4f071d0dfe0d2e57c44b9157680ef8d17a36323095c212f3fb09faf59d8c91c1
- SHA512
  
  1a5b6028890ec40ea2b56840b6d96f724a853e085a5171f14758353f5909626df1459610ffe22565b8de71a28d8bae3b30c01d1c01d145f56997060e8b5c43db
- SSDEEP
  
  3072:mFe/oCh46wP4TEx46CG2Q8yIsKAE6tH0rzZcPU7rWIC0IegnEWetqaDtbQK:mFChxwQU4e29yIzAbRQSXSIextqaDtQK
Score

10^/10

execution strrat discovery persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratdiscoveryexecutionpersistencestealertrojan