Overview

overview

10

Static

static

10

PTIN_Report_PDF.jar

windows7-x64

1

PTIN_Report_PDF.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2da0dbdf06277826bdc7e7a48aac75bddb572b2e2a2aaacb4ed6fd9724435bd9

  • Size

    203KB

  • Sample

    240906-zfcd9swhmm

  • MD5

    c34b438a0f693db2623a61b43cffa1db

  • SHA1

    122695aca182f85b0509b1f9564898e4ac471c80

  • SHA256

    2da0dbdf06277826bdc7e7a48aac75bddb572b2e2a2aaacb4ed6fd9724435bd9

  • SHA512

    8621b081034227e8da4f5032f8d8e8d9140000eb79947e11f6ecee1a227df9eb543bbcf7fc261d926e25f6a27a4320bdca0d49dea10090445cabd3cf287b57e9

  • SSDEEP

    6144:1F/DpIMnO/RzPRAqRyD95XxclU6hAD1SsbwFAl:1F/1IMnA6qRM95++6KSsXl

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

78.142.18.110:4001

193.142.146.101:4002
Attributes
  • license_id

    VGTC-23I1-3URP-OEH5-5KK7

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      PTIN_Report_PDF.jar

    • Size

      274KB

    • MD5

      b187065caca5efb5c27b6f7c7e30911e

    • SHA1

      5c95b2d528bb299882c65d96e1b6b40ae73d743e

    • SHA256

      b18a9dead26f002ca14b0edcd77bd06f251863316c6a6aff78fcb98427ee9fca

    • SHA512

      171220711d4dc96c138eeee5ff27c608ab1de1482e98b29bbd96eed386218fe82783d009074cba2a52bd13511c7bf1ffb881ffe28714ec1666fa9c5b8eb8f5ab

    • SSDEEP

      3072:sO+pajBcGuswdmusQpet/j5INeNvNdHT3RobaJTKja21QLc1T:1jGIwdRHpetigF1Vxf2N

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks