Overview

overview

10

Static

static

10

RFQ AE 3003910999.jar

windows7-x64

1

RFQ AE 3003910999.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ AE 3003910999.jar

  • Size

    264KB

  • Sample

    241125-gxlp6aymfk

  • MD5

    28ec6971f041bf8032f0cf107a4b998a

  • SHA1

    26521b13ff600ba008eb4cd29793e4eff19b4a0d

  • SHA256

    8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78

  • SHA512

    f510617be9820f58d3104866234057bcac17509c31ff0a52361eb2737d1cc8bc2b4a427c6bc948d3009432228ca7788a2ee5eb8204fa19221c33383bb5e9a71c

  • SSDEEP

    3072:+XfNv33luMlRapi+5MNlHAi7WlyUkg2Ac3B2At6L4g7f8TlD0e05fpo8RHCUUNmM:+FvFuMioq7uO6WfClDrojHCNmM

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

badmiles.ddns.net:5055

Attributes
  • license_id

    4OI0-V4TA-Z8G4-WQF1-B9VH

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      RFQ AE 3003910999.jar

    • Size

      264KB

    • MD5

      28ec6971f041bf8032f0cf107a4b998a

    • SHA1

      26521b13ff600ba008eb4cd29793e4eff19b4a0d

    • SHA256

      8a70ea299b970caec8bb342c024f36b731c315907797879c0b8d0385610aca78

    • SHA512

      f510617be9820f58d3104866234057bcac17509c31ff0a52361eb2737d1cc8bc2b4a427c6bc948d3009432228ca7788a2ee5eb8204fa19221c33383bb5e9a71c

    • SSDEEP

      3072:+XfNv33luMlRapi+5MNlHAi7WlyUkg2Ac3B2At6L4g7f8TlD0e05fpo8RHCUUNmM:+FvFuMioq7uO6WfClDrojHCNmM

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks