Overview

overview

10

Static

static

10

Shipping B...DF.jar

windows7-x64

3

Shipping B...DF.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f176ef480ce4a1d724c4a4f9285eaa51d86b91d6623277d2e1ecb42e38752d9d.zip

  • Size

    173KB

  • Sample

    241217-pp2emszpck

  • MD5

    9c28dd0c2a8bf65dc4534cf93ed895ab

  • SHA1

    c13c938ad568c6ec4a5d3040aa65a2823c4a440a

  • SHA256

    f176ef480ce4a1d724c4a4f9285eaa51d86b91d6623277d2e1ecb42e38752d9d

  • SHA512

    39422f41f69df6b89e51c801624d1a0a6a446e94a67e79745fb1fd2ab8637d83a2c5f7ac7818b892380415e451e1d8add3dbd132472e5dc2430e3da291a9f268

  • SSDEEP

    3072:1hDepamMhWCEUn5zhb0Az4cZvO2VBMe7Ip7WWeCRYDuhtj/du9YC:3epRuxhbdlB17QeCq61u9YC

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

evilginx.misecure.com:1790

Attributes
  • license_id

    RKA0-KES0-EPPK-UDRO-JNCG

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      Shipping Bill No6239999Dt09122024.PDF.jar

    • Size

      196KB

    • MD5

      fb02745de7ec057a90b207602e732be6

    • SHA1

      c1ecc13f6f7b8043918cc17a4fb88fb29c6ba9d0

    • SHA256

      84481aed848a500ec03fb0e95443a125eac073999aaf8391e221f72f75a33cb0

    • SHA512

      5e3c21bba3cc652bacb2b32187d62682f441f2e484386c850372dfb39cf2adce3b092dd4aa418bc7aa913f0f3a9527e68cabbe9a93158efd5ae3b997d05faa2e

    • SSDEEP

      3072:KROA9tsCGC9tChoYvQlzwVa37ZGfteVTzg4U5N0iVfG6lfAANinzk4U86vLiy:I9aLC9EjYrrZGfteVTyjn12ANmo4Jy

    Score
    10/10
    discoverystrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks