Overview

overview

10

Static

static

1

Request Fo...ion.js

windows7-x64

3

Request Fo...ion.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request For Quotation.js

  • Size

    199KB

  • Sample

    241009-pdrfasydna

  • MD5

    49f2c6993c2a5f6e4a32904c1c7fbb61

  • SHA1

    1a400b47dac40dcf7469146a5e0fc192f5d74b05

  • SHA256

    6e27ff665ecc3c572d7eb8d40c2f46dd0d382b85798f17eff5152b44c5b8cddf

  • SHA512

    af76eaee80fb336fbf89bb888f289974cd5528cba7b5e8cb98996e02d5254c2ca04e4a80f508ed67196f30658dc56254f9d45efebaa3f4e124c39585dea2fedf

  • SSDEEP

    6144:HQd0MNj/o/zfzm0GJqT3gl4zYhDFzCpsU6k7oUGjje:wEPbziE1p

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      Request For Quotation.js

    • Size

      199KB

    • MD5

      49f2c6993c2a5f6e4a32904c1c7fbb61

    • SHA1

      1a400b47dac40dcf7469146a5e0fc192f5d74b05

    • SHA256

      6e27ff665ecc3c572d7eb8d40c2f46dd0d382b85798f17eff5152b44c5b8cddf

    • SHA512

      af76eaee80fb336fbf89bb888f289974cd5528cba7b5e8cb98996e02d5254c2ca04e4a80f508ed67196f30658dc56254f9d45efebaa3f4e124c39585dea2fedf

    • SSDEEP

      6144:HQd0MNj/o/zfzm0GJqT3gl4zYhDFzCpsU6k7oUGjje:wEPbziE1p

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks