Overview

overview

10

Static

static

1

QUOTATION.js

windows7-x64

3

QUOTATION.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION.js

  • Size

    202KB

  • Sample

    250205-vfmssavqat

  • MD5

    c3399d5962cf0c35d267fa5157e1a1e9

  • SHA1

    0fe5746c7e7ba86f5ce85f07e1cd2b2d391f17ac

  • SHA256

    dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c

  • SHA512

    3376bc35195a7f89035ef55f18cd5dfdbc7185cd402ec8884584ac7159523af20267a3aa3fbd809496c2a06d44b6eaf2f1f5b92c63033b2db04e9bd111616710

  • SSDEEP

    3072:eQ/b8kU1KiwwFAaXoq271qPihljhmS/NeuTP9YTeGiNgphTmVWzai//Hocnih82:eQ/JU1KfSiUMjhmSlBT1YJiNg/vpHtQ

Score
10/10
strratexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      QUOTATION.js

    • Size

      202KB

    • MD5

      c3399d5962cf0c35d267fa5157e1a1e9

    • SHA1

      0fe5746c7e7ba86f5ce85f07e1cd2b2d391f17ac

    • SHA256

      dc628151dd00039d1f96e11cfffcca93ca411132073a71b5bf9bee3d5368a56c

    • SHA512

      3376bc35195a7f89035ef55f18cd5dfdbc7185cd402ec8884584ac7159523af20267a3aa3fbd809496c2a06d44b6eaf2f1f5b92c63033b2db04e9bd111616710

    • SSDEEP

      3072:eQ/b8kU1KiwwFAaXoq271qPihljhmS/NeuTP9YTeGiNgphTmVWzai//Hocnih82:eQ/JU1KfSiUMjhmSlBT1YJiNg/vpHtQ

    Score
    10/10
    executionstrratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks