Overview

overview

10

Static

static

10

TT USD125,...24.jar

windows7-x64

3

TT USD125,...24.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24092024_1128_23092024_TT USD125,207 - 23.9.2024.zip

  • Size

    282KB

  • Sample

    240924-nlaxvashjl

  • MD5

    0c569eac2270c279013aedf6d4250e51

  • SHA1

    f7d58b82a019ba7db04b294e50b51558aa5c9818

  • SHA256

    63d44bf1a588511a3a1b0ccbde6a2426ea8e39f49e3cc748856e0da209d9cc9a

  • SHA512

    8579a209bbd6c5e606c1970bbab9537421f3f5b02efe9c01c298cb70e2c69ef54b9bf8f655c2b38e3414ad07900e4c0a5b05e95f209c63e547dba6071f207abd

  • SSDEEP

    6144:1/a0rd3jWa3QIplyNuzpfgLSyj12i5Mob8/u1YyB:vrd3CsQIplLzVg92+MpW6yB

Score
10/10
adwindstrratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      TT USD125,207 - 23.9.2024.jar

    • Size

      282KB

    • MD5

      085b0d7b2ab0862abe65c54e50e25415

    • SHA1

      c7c215b0a6fb35394ac65ecf2179a8cba70b0164

    • SHA256

      d32fd7b9dae043243301bc041980215535fd5208e252c3aec703d43fb1c98ec2

    • SHA512

      b23377f973c5c576f04305613d98cfb1a0053ae7239acfe7f6e1a6b7554cf231fbe46caa18db4787e6d59798148e904599d5d2f60863e25d9b1a474ad88f801f

    • SSDEEP

      6144:dBG0lV3jUa3QKplCNuVpfgtSUjH2y5Mobu/uHYNUSG:1lV34sQKpl7VVgB2OM1W4N5G

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks