Overview

overview

10

Static

static

10

RichiestaOrdine.jar

windows7-x64

1

RichiestaOrdine.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RichiestaOrdine.jar

  • Size

    84KB

  • Sample

    240906-pmah5swhje

  • MD5

    5acb5f7762f565fb8048d7eb2f68c30d

  • SHA1

    9280824a7f831fee6a4c8b2f737892e9ef91a5ca

  • SHA256

    167e8b53c7c1959f05a788d95982ff056591146e7b9711cd9e041347cf21db34

  • SHA512

    7e30e4d7a8653a995bef974447e79b44d552fa35e6966315089a2da3d6eeb22e10354ed733ae0b6e3d66ff55f5d7053540faf3784690b661269d29ee8f59d83e

  • SSDEEP

    1536:7QKhXzU/FbhBxMOeWNgSmJyQhBFVv4WFJdiM+i8B:EKpU/dSlWNgSm4QJ2kdJ+

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

elastsolek1.duckdns.org:4787

zekeriyasolek45.duckdns.org:4787
Attributes
  • license_id

    WFC9-W4KB-388F-9KY1-S6JV

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      RichiestaOrdine.jar

    • Size

      84KB

    • MD5

      5acb5f7762f565fb8048d7eb2f68c30d

    • SHA1

      9280824a7f831fee6a4c8b2f737892e9ef91a5ca

    • SHA256

      167e8b53c7c1959f05a788d95982ff056591146e7b9711cd9e041347cf21db34

    • SHA512

      7e30e4d7a8653a995bef974447e79b44d552fa35e6966315089a2da3d6eeb22e10354ed733ae0b6e3d66ff55f5d7053540faf3784690b661269d29ee8f59d83e

    • SSDEEP

      1536:7QKhXzU/FbhBxMOeWNgSmJyQhBFVv4WFJdiM+i8B:EKpU/dSlWNgSm4QJ2kdJ+

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks