Overview

overview

10

Static

static

1

Quotation Spec.js

windows7-x64

3

Quotation Spec.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Quotation Spec.js

  • Size

    205KB

  • Sample

    240921-z4fftstgph

  • MD5

    0696c7901122e77fa14c809f27a6aad9

  • SHA1

    19d3756f324115ab95132fe51af131139b172464

  • SHA256

    2a795381c3f24bb2dff736aee0688aa59b175e298d80c0c9a07641494c44c6a1

  • SHA512

    a0fe885d56e0ee25648bfa67fc5b60220d224a29e1f11f456a6451a104b0b752ab534962dfffa143f0c2b9617e8472cec8822863ae78ae53e42f322651e37524

  • SSDEEP

    6144:HQblscPp7Odm/khWV/wUS5rxvUbwFpzBy3PhiZaWUcvitF:waOLkMILxLs3PhiZaWUcviL

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      Quotation Spec.js

    • Size

      205KB

    • MD5

      0696c7901122e77fa14c809f27a6aad9

    • SHA1

      19d3756f324115ab95132fe51af131139b172464

    • SHA256

      2a795381c3f24bb2dff736aee0688aa59b175e298d80c0c9a07641494c44c6a1

    • SHA512

      a0fe885d56e0ee25648bfa67fc5b60220d224a29e1f11f456a6451a104b0b752ab534962dfffa143f0c2b9617e8472cec8822863ae78ae53e42f322651e37524

    • SSDEEP

      6144:HQblscPp7Odm/khWV/wUS5rxvUbwFpzBy3PhiZaWUcvitF:waOLkMILxLs3PhiZaWUcviL

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks