Overview

overview

10

Static

static

1

PO#518463.js

windows7-x64

3

PO#518463.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    158792c08431083ed4a2b947b78dc8cae334e00b2c8e8335f85e4bf4c78bce60

  • Size

    282KB

  • Sample

    240926-xd8nkssbln

  • MD5

    7ae3496c75020f0660608b487b7c244d

  • SHA1

    e04f835fb7f5ac419dc9a08ea49a424eeb86558f

  • SHA256

    158792c08431083ed4a2b947b78dc8cae334e00b2c8e8335f85e4bf4c78bce60

  • SHA512

    c45e45b81116a98898cf8b0a5d19f8e830953dd89c3909f8f2f50fac34822548bf89de635a99c18fef62aa74b728c858ad602daf101b2f9f897b28a75fad05bb

  • SSDEEP

    6144:px60UYeMw2F4p8evRVh4S1FjgJXvPAXj+12V9LMOfut3WR6d8LN7T8:z60U84pZVdsJXgz+YjJfkWQd8FT8

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      PO#518463.js

    • Size

      453KB

    • MD5

      f04f4fb3190c6cd423a4d84cf521cf65

    • SHA1

      9d11423067f7e004d14a3803b3fe2ee046ab3dfd

    • SHA256

      5709dc35796f2a91483860820770e74dead9f01eaf2433832016fdacd2eed209

    • SHA512

      6bf28689632f5c7f8a19e03e3d2efd7af34f6d6d73f8f78c4b5ae97f7af051e85cbaac40640334cfe089337aa0c5388a11ad4e7a71e98841ea67585c710c1162

    • SSDEEP

      12288:woWNEiYoNEy3ND5k6XrhqncWkhLPDS430IR:w4SR5xbWkhLN30s

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks