Overview

overview

10

Static

static

1

PL#40704.jar

windows7-x64

1

PL#40704.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PL#40704.jar

  • Size

    400KB

  • Sample

    240730-dthbsatdpq

  • MD5

    1562675352c69cc1ecba3c247501af29

  • SHA1

    5beeeb995f7a0a5550eaf97ffd010992ee716643

  • SHA256

    4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd

  • SHA512

    7db315a671af8ac38835b632d3dba8e133f5ece241cb7f4a0b0f375620268cbf4ac6fa215fd5fc0c166f19561ef55d6f08ad67821e46c731570b8bb1f8545f6d

  • SSDEEP

    12288:0QKsHTT5/YEwDFoEv763/qSncsfP9iNoDQ:0hoTT5dQOvhP9QeQ

Score
10/10
strratpersistencestealertrojan

Malware Config

Targets

    • Target

      PL#40704.jar

    • Size

      400KB

    • MD5

      1562675352c69cc1ecba3c247501af29

    • SHA1

      5beeeb995f7a0a5550eaf97ffd010992ee716643

    • SHA256

      4c249b325125235b50d9690560c4197a28fd62901b5e02d9eba7436b29447cdd

    • SHA512

      7db315a671af8ac38835b632d3dba8e133f5ece241cb7f4a0b0f375620268cbf4ac6fa215fd5fc0c166f19561ef55d6f08ad67821e46c731570b8bb1f8545f6d

    • SSDEEP

      12288:0QKsHTT5/YEwDFoEv763/qSncsfP9iNoDQ:0hoTT5dQOvhP9QeQ

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks