adwind | 7a85be46c2ea87761f8453850accabed698b20ae24994e3f36a9d4fa4b34e1ad | Triage

Sharing

General

Target

7a85be46c2ea87761f8453850accabed698b20ae24994e3f36a9d4fa4b34e1ad.jar
Size

124KB
Sample

240822-b8jgaawdjm
MD5

9b6b8d9e9c4a78a56dd7f3ff3910d123
SHA1

063bc159f1a611329e1713b4dd464589311f4ac4
SHA256

7a85be46c2ea87761f8453850accabed698b20ae24994e3f36a9d4fa4b34e1ad
SHA512

4a0980b766efb187a4869685bb986f20111268282f80da1c287cbbadb50e6eaba8d2ce46733e627530826d367a13d5351f08eabe48830445925ddbd3be189026
SSDEEP

3072:DqZlIC+q92TZzGmr3EyyF5cRAzDLmiLqnp8559FX:exT2ZDDExDLFenG3FX

Score

10^/10

adwind strrat execution persistence stealer trojan

Malware Config

Targets

- Target
  
  7a85be46c2ea87761f8453850accabed698b20ae24994e3f36a9d4fa4b34e1ad.jar
- Size
  
  124KB
- MD5
  
  9b6b8d9e9c4a78a56dd7f3ff3910d123
- SHA1
  
  063bc159f1a611329e1713b4dd464589311f4ac4
- SHA256
  
  7a85be46c2ea87761f8453850accabed698b20ae24994e3f36a9d4fa4b34e1ad
- SHA512
  
  4a0980b766efb187a4869685bb986f20111268282f80da1c287cbbadb50e6eaba8d2ce46733e627530826d367a13d5351f08eabe48830445925ddbd3be189026
- SSDEEP
  
  3072:DqZlIC+q92TZzGmr3EyyF5cRAzDLmiLqnp8559FX:exT2ZDDExDLFenG3FX
Score

10^/10

execution strrat persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratexecutionpersistencestealertrojan