Overview

overview

10

Static

static

10

ngjdawgfob.jar

windows7-x64

1

ngjdawgfob.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ngjdawgfob.jar

  • Size

    92KB

  • Sample

    250213-qh9m4synft

  • MD5

    878180ed3a5baf3352b3ea3d92a3c52b

  • SHA1

    144a9b7b6d8309b44f9631156fa1ff4381204943

  • SHA256

    1bf26c165f67d151302623a90f09cf3835d9cba760253729429728238b865aee

  • SHA512

    ac31f13f7bcc4597c3d886bb78649db621ca36152365284e87eb29e6dbd7991a14e8be9450e500dae71938c88fb375cb1d9aa9748a39b5c4a30b2f33c06bed66

  • SSDEEP

    1536:FDv/O1A/aP1a9QQ1+jdncW8nGSPPsV9k0jpLZGjITwaIheX8DHGvjvxupvHrZI3:FvL/aP12Q1jkG2PQ9lj9ZG0TrX8ivuLI

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

harold.jetos.com:3608

Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    true

  • startup

    false

Targets

    • Target

      ngjdawgfob.jar

    • Size

      92KB

    • MD5

      878180ed3a5baf3352b3ea3d92a3c52b

    • SHA1

      144a9b7b6d8309b44f9631156fa1ff4381204943

    • SHA256

      1bf26c165f67d151302623a90f09cf3835d9cba760253729429728238b865aee

    • SHA512

      ac31f13f7bcc4597c3d886bb78649db621ca36152365284e87eb29e6dbd7991a14e8be9450e500dae71938c88fb375cb1d9aa9748a39b5c4a30b2f33c06bed66

    • SSDEEP

      1536:FDv/O1A/aP1a9QQ1+jdncW8nGSPPsV9k0jpLZGjITwaIheX8DHGvjvxupvHrZI3:FvL/aP12Q1jkG2PQ9lj9ZG0TrX8ivuLI

    Score
    10/10
    strratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Downloads MZ/PE file

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks