Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

06032025_0...92.jar

windows7-x64

1

06032025_0...92.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06032025_0051_CN_82727277362632736420099283uwh2DBEROOWLWO_REF_MUEUWEU-UWIWD9292.jar

  • Size

    267KB

  • Sample

    250306-a7jvzstvhw

  • MD5

    cf27c3ff5ae2975534befb855d826c49

  • SHA1

    7eaa84345e1edfa7cf1621e30367926146728760

  • SHA256

    9a048c1ab9f6585996c7d8d86f197b80e6387a9fb44f12750fefd541ca9aedb8

  • SHA512

    43d958d532508c91e1096bd2bf0c19126ba150f57410cd88efd650538653141fc5f5d639c6c48389887ebb5afddb202dd225845ed6d53930715cb3cc4488028a

  • SSDEEP

    3072:ONIrKquwxuXkXyMLQShsur8rrQ5SMY8RBjq4xAyiKdrJsgAcSOtI9fWSjUi1W1YU:vluwxuXkXj5qKyirnAdOtxSZDTw

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

ajaramyrus.duckdns.org:5686

127.0.01:5686
Attributes
  • license_id

    G8RJ-32K8-DAFD-KIMM-TXTY

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      06032025_0051_CN_82727277362632736420099283uwh2DBEROOWLWO_REF_MUEUWEU-UWIWD9292.jar

    • Size

      267KB

    • MD5

      cf27c3ff5ae2975534befb855d826c49

    • SHA1

      7eaa84345e1edfa7cf1621e30367926146728760

    • SHA256

      9a048c1ab9f6585996c7d8d86f197b80e6387a9fb44f12750fefd541ca9aedb8

    • SHA512

      43d958d532508c91e1096bd2bf0c19126ba150f57410cd88efd650538653141fc5f5d639c6c48389887ebb5afddb202dd225845ed6d53930715cb3cc4488028a

    • SSDEEP

      3072:ONIrKquwxuXkXyMLQShsur8rrQ5SMY8RBjq4xAyiKdrJsgAcSOtI9fWSjUi1W1YU:vluwxuXkXj5qKyirnAdOtxSZDTw

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks