Overview

overview

10

Static

static

10

Shipping B...DF.jar

windows7-x64

3

Shipping B...DF.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a74fc7f878df16614e19a516028df03780faa5f8526ce545a8d5dcfcd28cc26b.zip

  • Size

    173KB

  • Sample

    241217-pp2emsyqhw

  • MD5

    7c81fda49fc93a0f9c674a962a4aa372

  • SHA1

    201bf8fc82788d0f970833d64b4e2f072d85b7ad

  • SHA256

    a74fc7f878df16614e19a516028df03780faa5f8526ce545a8d5dcfcd28cc26b

  • SHA512

    6524ee5d15f5e2c5de5f8ccebe26ead3bc16db8f56e083f90152cdf2f5b4dc21a0bf509fe17c1ecdc3ad8f6825a824ce2873cfea8ea406f960f6f9befcbd8128

  • SSDEEP

    3072:S3/IlG7cCjSlVwhhhwj0Dx6kQQNpzNdVfU9CYrOAOzNy2gRXFOTEs9dQ:S3/IlGLWlqfwAs+1NdVfkqzLgonQ

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

evilginx.misecure.com:1790

Attributes
  • license_id

    RKA0-KES0-EPPK-UDRO-JNCG

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      Shipping Bill6239999 dated 13122024.PDF.jar

    • Size

      196KB

    • MD5

      01fd77362fbe5b158352d203bf4e264d

    • SHA1

      b707961bf70f6798103b0f9dcf516ca3fb63a52f

    • SHA256

      9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b

    • SHA512

      c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7

    • SSDEEP

      3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x

    Score
    10/10
    discoverystrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks