Extracted

• • Target

    461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe

  • Size

    480KB

  • MD5

    aac338140e178a3cac423d3454cc7467

  • SHA1

    a9c195e15b4109d4ece1309fb4e3b3bd77145421

  • SHA256

    461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb

  • SHA512

    a96b2c8c985feccbc385a8ba1e7583be6913db7da15244b136c203f7ca320a03727425f3927c21157eae0c4da3fbbdd8fb71373655c6824544296ec66df834f2

  • SSDEEP

    12288:PkQNy5kuH2lZ6r4os6WQMiyvtJMDiXxJfrJyru:XvuHTr4J7Qw1JJXxJ0ru

  Score

  10^/10

  strratdiscoverystealertrojanpersistence

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2