Overview

overview

10

Static

static

1

Tax Return...765.js

windows7-x64

3

Tax Return...765.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Tax Returns Of R38,765.js

  • Size

    211KB

  • Sample

    241022-p73qeswcpc

  • MD5

    e947528c147eb16988daa321ae3cd7ea

  • SHA1

    3d8b74f4215266a55a81c2024af8748357250c62

  • SHA256

    9f447130d0bfc9381af846b22967c76537b8ebf452c241c1b78c1e55ce50843e

  • SHA512

    5ebd763f9a1461b05b5b78f46b865e6e086442480540e22914b3f496e226243a350533f5081bd7bb33f9d4763107c0caa12d97cfff521839763dfc13f63f0b8e

  • SSDEEP

    6144:DQBDS9zYBtO2eZxZZjk88ZNTJrpXrZgZkm:kBsexILyLlFrZQ

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      Tax Returns Of R38,765.js

    • Size

      211KB

    • MD5

      e947528c147eb16988daa321ae3cd7ea

    • SHA1

      3d8b74f4215266a55a81c2024af8748357250c62

    • SHA256

      9f447130d0bfc9381af846b22967c76537b8ebf452c241c1b78c1e55ce50843e

    • SHA512

      5ebd763f9a1461b05b5b78f46b865e6e086442480540e22914b3f496e226243a350533f5081bd7bb33f9d4763107c0caa12d97cfff521839763dfc13f63f0b8e

    • SSDEEP

      6144:DQBDS9zYBtO2eZxZZjk88ZNTJrpXrZgZkm:kBsexILyLlFrZQ

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks