Overview

overview

10

Static

static

1

aa3641a70d...18.vbs

windows7-x64

10

aa3641a70d...18.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa3641a70d4bf48894b9e62420055c83_JaffaCakes118

  • Size

    246KB

  • Sample

    240614-rzdgnsvcme

  • MD5

    aa3641a70d4bf48894b9e62420055c83

  • SHA1

    b14e467dcde6ef99866cb0835ce2d2df6c1b921f

  • SHA256

    232fea54ac8321f41fa38a31ea3118b7821cb635ebefe1794c6d2e3399d2645a

  • SHA512

    ea372bf621076cbbb628e885428dcaaff2476ddbdebb067c564c9cf567a38bf110d1a4378dd5cdac7935160f2184410ff8e2d2d9f46562c99fbce5232ad186d7

  • SSDEEP

    6144:xxgPhA9k5Ffy9be37tVTfxAj8BjuuPi1hs:xxgvvKOVT5Aj8BjTins

Score
10/10
strratwshratdiscoveryexecutionpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

104.248.53.108:8898

Attributes
  • license_id

    HCXX-4KTB-4WZA-FBIK-9QEC

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Extracted

Family

wshrat

C2

http://pluginsrv2.duckdns.org:8899

Targets

    • Target

      aa3641a70d4bf48894b9e62420055c83_JaffaCakes118

    • Size

      246KB

    • MD5

      aa3641a70d4bf48894b9e62420055c83

    • SHA1

      b14e467dcde6ef99866cb0835ce2d2df6c1b921f

    • SHA256

      232fea54ac8321f41fa38a31ea3118b7821cb635ebefe1794c6d2e3399d2645a

    • SHA512

      ea372bf621076cbbb628e885428dcaaff2476ddbdebb067c564c9cf567a38bf110d1a4378dd5cdac7935160f2184410ff8e2d2d9f46562c99fbce5232ad186d7

    • SSDEEP

      6144:xxgPhA9k5Ffy9be37tVTfxAj8BjuuPi1hs:xxgvvKOVT5Aj8BjTins

    Score
    10/10
    strratexecutionpersistencestealertrojanwshratdiscovery

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks