Overview

overview

10

Static

static

1

SWIFT-MT10...024.js

windows7-x64

3

SWIFT-MT10...024.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SWIFT-MT103-17112024.js

  • Size

    240KB

  • Sample

    241120-hptapsxqhj

  • MD5

    ee561cb65c1c091022c0fc74326ed6e1

  • SHA1

    0c7451bdeaf769da591e070537472d2514f138eb

  • SHA256

    e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf

  • SHA512

    d349da1e356830d3109262f683f0d7b27da98ad56bd07ad43849fc712cd8c1985e23b5639a07fbe9717a70736844cd8df20b7411985ebbb43f397c1700585d38

  • SSDEEP

    6144:eQLk79lpKjq/aJYrMfy7wJfVm642LbIXSBFfAfx1:1LwAz6kFueIXCIfP

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      SWIFT-MT103-17112024.js

    • Size

      240KB

    • MD5

      ee561cb65c1c091022c0fc74326ed6e1

    • SHA1

      0c7451bdeaf769da591e070537472d2514f138eb

    • SHA256

      e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf

    • SHA512

      d349da1e356830d3109262f683f0d7b27da98ad56bd07ad43849fc712cd8c1985e23b5639a07fbe9717a70736844cd8df20b7411985ebbb43f397c1700585d38

    • SSDEEP

      6144:eQLk79lpKjq/aJYrMfy7wJfVm642LbIXSBFfAfx1:1LwAz6kFueIXCIfP

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks