Overview

overview

10

Static

static

1

3aa4075925...1d.jar

windows7-x64

1

3aa4075925...1d.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar

  • Size

    481KB

  • Sample

    240608-bhg6jafg82

  • MD5

    3a8408bd24e0c03eff82e67943d10f23

  • SHA1

    15905ce2e7170b6dd2110d793820665a5d7ea1eb

  • SHA256

    3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d

  • SHA512

    46044d9727ae1ee10dd7f0aa108b3717cb2dccd995d505af115f35edb45b649a47533ccabd50d2a2c44d90a87ababc231e2acc01672dfe35f02eb7b739653d20

  • SSDEEP

    12288:6tlWvKeQSPEUpTroRFoRb5h7BC2JBMct62xKcO:6fWvlvXoEtMM62S

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d.jar

    • Size

      481KB

    • MD5

      3a8408bd24e0c03eff82e67943d10f23

    • SHA1

      15905ce2e7170b6dd2110d793820665a5d7ea1eb

    • SHA256

      3aa407592573d9cdc3527c18d778d71b83dfbc9bc6b638f619229d9d8c51d61d

    • SHA512

      46044d9727ae1ee10dd7f0aa108b3717cb2dccd995d505af115f35edb45b649a47533ccabd50d2a2c44d90a87ababc231e2acc01672dfe35f02eb7b739653d20

    • SSDEEP

      12288:6tlWvKeQSPEUpTroRFoRb5h7BC2JBMct62xKcO:6fWvlvXoEtMM62S

    Score
    10/10
    strratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks