Overview

overview

10

Static

static

10

ShippingBi...DF.jar

windows7-x64

3

ShippingBi...DF.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ShippingBillNo6239999Dt09122024.PDF.jar

  • Size

    196KB

  • Sample

    241217-mwz42sykfq

  • MD5

    fb02745de7ec057a90b207602e732be6

  • SHA1

    c1ecc13f6f7b8043918cc17a4fb88fb29c6ba9d0

  • SHA256

    84481aed848a500ec03fb0e95443a125eac073999aaf8391e221f72f75a33cb0

  • SHA512

    5e3c21bba3cc652bacb2b32187d62682f441f2e484386c850372dfb39cf2adce3b092dd4aa418bc7aa913f0f3a9527e68cabbe9a93158efd5ae3b997d05faa2e

  • SSDEEP

    3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

evilginx.misecure.com:1790

Attributes
  • license_id

    RKA0-KES0-EPPK-UDRO-JNCG

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      ShippingBillNo6239999Dt09122024.PDF.jar

    • Size

      196KB

    • MD5

      fb02745de7ec057a90b207602e732be6

    • SHA1

      c1ecc13f6f7b8043918cc17a4fb88fb29c6ba9d0

    • SHA256

      84481aed848a500ec03fb0e95443a125eac073999aaf8391e221f72f75a33cb0

    • SHA512

      5e3c21bba3cc652bacb2b32187d62682f441f2e484386c850372dfb39cf2adce3b092dd4aa418bc7aa913f0f3a9527e68cabbe9a93158efd5ae3b997d05faa2e

    • SSDEEP

      3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy

    Score
    10/10
    discoverystrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks