Overview

overview

10

Static

static

10

9dbfb2b2c6...2b.jar

windows7-x64

1

9dbfb2b2c6...2b.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b.jar

  • Size

    196KB

  • Sample

    241218-dprpnasjdm

  • MD5

    01fd77362fbe5b158352d203bf4e264d

  • SHA1

    b707961bf70f6798103b0f9dcf516ca3fb63a52f

  • SHA256

    9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b

  • SHA512

    c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7

  • SSDEEP

    3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

evilginx.misecure.com:1790

Attributes
  • license_id

    RKA0-KES0-EPPK-UDRO-JNCG

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b.jar

    • Size

      196KB

    • MD5

      01fd77362fbe5b158352d203bf4e264d

    • SHA1

      b707961bf70f6798103b0f9dcf516ca3fb63a52f

    • SHA256

      9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b

    • SHA512

      c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7

    • SSDEEP

      3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks