Overview

overview

10

Static

static

1

Tax Return...765.js

windows7-x64

3

Tax Return...765.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TaxReturnsOfR38765.001.rar

  • Size

    120KB

  • Sample

    241022-qt6qlaxdqe

  • MD5

    07fac368a63cdb33dfc4393e678abc3c

  • SHA1

    28b7f35e399098d6f51125cd1e71f4dc61d103f0

  • SHA256

    06f7123135336ac5bb165b61c09e0f91d85f1d4b86b5cab6f1b2db8a4f84f432

  • SHA512

    fffdcaab8274230edd64c132f32dc528c92e522a4f9a646db5251f6920c18f1d1fcae56e7030f92ed1a03fd787196cec42db4a359194a1df921de48995fccd99

  • SSDEEP

    3072:UUTY7vFXWG+OKm3+h7tnXSsKiUsH4e/5PbKa2EV0:FT8dGT2+5tnXbKiUsHv/5POrN

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      Tax Returns Of R38,765.js

    • Size

      211KB

    • MD5

      e947528c147eb16988daa321ae3cd7ea

    • SHA1

      3d8b74f4215266a55a81c2024af8748357250c62

    • SHA256

      9f447130d0bfc9381af846b22967c76537b8ebf452c241c1b78c1e55ce50843e

    • SHA512

      5ebd763f9a1461b05b5b78f46b865e6e086442480540e22914b3f496e226243a350533f5081bd7bb33f9d4763107c0caa12d97cfff521839763dfc13f63f0b8e

    • SSDEEP

      6144:DQBDS9zYBtO2eZxZZjk88ZNTJrpXrZgZkm:kBsexILyLlFrZQ

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks