Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

DOCUMENTS002.PDF.jar

windows7-x64

1

DOCUMENTS002.PDF.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13032025_1406_DOCUMENTS002.PDF.jar.zip

  • Size

    186KB

  • Sample

    250313-rejsysxkt7

  • MD5

    9f8c87a99cc2cf8d9e7d24a67680767f

  • SHA1

    8089d8ce7c7d1ab2461eb85bd45dc019c0791ab9

  • SHA256

    ba3869476b4473176eaa47204430c75eb2f9f3a4b67cb025fe62ffc344c79139

  • SHA512

    6acdfc12ade2b835490987df5e590272b2c6988c5cbb92c41385ed095ffdffed8bf5360f063b530fe6ce6e230f0bbe220809c742a42e789a6ceec6d903f527d7

  • SSDEEP

    3072:FZJL9bX7mAtsHAUtQC4Dh0eNMv2r13T9CeR2gT8el3voPijXISfj:vJLFXVtIIh0eNmG1DDRtoe5voPijXt

Score
10/10
strratpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

eastsiders.mefound.com:1794

Attributes
  • license_id

    IIZH-5GR9-567Z-IO0J-WWD7

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Targets

    • Target

      DOCUMENTS002.PDF.jar

    • Size

      211KB

    • MD5

      1d85e90da37068b469c780fc7a48e39d

    • SHA1

      fd8c444b811ed76f1f21656db03fc4488cc07309

    • SHA256

      5f254a78f046f08ddd45e1c1dfcdb3fe0be8258b207f874bc95bf269fe0713fa

    • SHA512

      f65fae46e5a6320e052a52b5535e2c0a84b569abd4d1ea314499ec6791172492a3e4f36462bd88a22638fa75cdf2bc1049a313a7389097e66b87cbe435878e23

    • SSDEEP

      3072:szR7A2Y0gUMxGZrrOVCobiBTr7zVTL8mPfiswap2OGr64BH4eyfJuoXvIFLB+yTz:4RLtMxyOVHiF75Tok7p2hNkIF1+yTbYQ

    Score
    10/10
    strratpersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Strrat family

      strrat

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks