Overview

overview

10

Static

static

10

JaffaCakes...61.jar

windows7-x64

1

JaffaCakes...61.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_f96a223f991fb73ca696cec01c563661

  • Size

    184KB

  • Sample

    250111-g6r9asylfv

  • MD5

    f96a223f991fb73ca696cec01c563661

  • SHA1

    4d05b60435bbf1406721e2766dfa75913f144f06

  • SHA256

    b419dd50e24658fb5baa734cec6e8df03778000d2743842108e6de48763a3576

  • SHA512

    65687a47ce1c84322bc590ee8888d43316a4e57c18600e60b57bda7727c0f7483c3476e6ce4c0c71f7b33919fff1cdbee9652e22987daa9a459c5b89f6a94c54

  • SSDEEP

    3072:hWRLOLgudl05cfPSlGg67guvyyUEJ5xEPqPGAeK3mVLK5hCsDx8zusc0b4R:hWRL8UcnSQgkhUDRAZp5h7sc00

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

31.210.20.102:2664

127.0.0.1:2664
Attributes
  • license_id

    FDFL-86AF-249Z-UP6D-RTBW

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      JaffaCakes118_f96a223f991fb73ca696cec01c563661

    • Size

      184KB

    • MD5

      f96a223f991fb73ca696cec01c563661

    • SHA1

      4d05b60435bbf1406721e2766dfa75913f144f06

    • SHA256

      b419dd50e24658fb5baa734cec6e8df03778000d2743842108e6de48763a3576

    • SHA512

      65687a47ce1c84322bc590ee8888d43316a4e57c18600e60b57bda7727c0f7483c3476e6ce4c0c71f7b33919fff1cdbee9652e22987daa9a459c5b89f6a94c54

    • SSDEEP

      3072:hWRLOLgudl05cfPSlGg67guvyyUEJ5xEPqPGAeK3mVLK5hCsDx8zusc0b4R:hWRL8UcnSQgkhUDRAZp5h7sc00

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks