strrat | 19fff8df6f516a8f4238e8da59950d1a29d8eb9c709be012aa6b7c1d100e0c8a | Triage

Sharing

General

Target

19fff8df6f516a8f4238e8da59950d1a29d8eb9c709be012aa6b7c1d100e0c8a
Size

400KB
Sample

240928-rhwlxszcpr
MD5

906e5517af46030a70c411c841208ad6
SHA1

caecf91a468e492694e54be1f00dd67407c33734
SHA256

19fff8df6f516a8f4238e8da59950d1a29d8eb9c709be012aa6b7c1d100e0c8a
SHA512

57d081e206ff4f7fb8558c573f323fbce4f132062c714dcb576b96abf03fa37c98f1beae54f12af9cd6fff2abd4321985eae6dbc02c190aa0f7576f6d3b12972
SSDEEP

12288:aRrWHTQ5a9ZVDBotv7V3JZCjc9NP9iNSe:aNSTQ5EuJ5vP9QR

Score

10^/10

strrat persistence stealer trojan

Malware Config

Targets

- Target
  
  19fff8df6f516a8f4238e8da59950d1a29d8eb9c709be012aa6b7c1d100e0c8a
- Size
  
  400KB
- MD5
  
  906e5517af46030a70c411c841208ad6
- SHA1
  
  caecf91a468e492694e54be1f00dd67407c33734
- SHA256
  
  19fff8df6f516a8f4238e8da59950d1a29d8eb9c709be012aa6b7c1d100e0c8a
- SHA512
  
  57d081e206ff4f7fb8558c573f323fbce4f132062c714dcb576b96abf03fa37c98f1beae54f12af9cd6fff2abd4321985eae6dbc02c190aa0f7576f6d3b12972
- SSDEEP
  
  12288:aRrWHTQ5a9ZVDBotv7V3JZCjc9NP9iNSe:aNSTQ5EuJ5vP9QR
Score

10^/10

strrat persistence stealer trojan
- STRRAT
  STRRAT is a remote access tool than can steal credentials and log keystrokes.
  trojan stealer strrat
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

strratpersistencestealertrojan