Overview

overview

10

Static

static

10

e4bc1b6f2e...ae.jar

windows7-x64

3

e4bc1b6f2e...ae.jar

windows10-2004-x64

10

Resubmissions

21-06-2024 17:49

240621-wea82ayeph 10

09-06-2024 09:22

240609-lb4fasgf3w 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae.jar

  • Size

    123KB

  • Sample

    240621-wea82ayeph

  • MD5

    6a6bcf5dbe9ee0e68969958ca3565122

  • SHA1

    c515cd6309bdff8f1b7b996f0846eae3ea27b768

  • SHA256

    e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae

  • SHA512

    2dc5021ce4e033a1ae67ec2905b3acb7b237c3a00bebe54b030f461675ceb570e738743348a889ea3400b7d01e6261edb5d835c4759914960ae29cbba98a00a6

  • SSDEEP

    3072:4+1ksmuRo+BmpH7Rx/inqhzlE0EP5vdRGXVIJeouw:2sHbmpRgnqhzPEP5vbGXiuw

Score
10/10
adwindstrratdiscoveryexecutionpersistencestealertrojan

Malware Config

Targets

    • Target

      e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae.jar

    • Size

      123KB

    • MD5

      6a6bcf5dbe9ee0e68969958ca3565122

    • SHA1

      c515cd6309bdff8f1b7b996f0846eae3ea27b768

    • SHA256

      e4bc1b6f2e541e90a1ed736284d2e383fcb739f10466b1fdd390211e01ed4dae

    • SHA512

      2dc5021ce4e033a1ae67ec2905b3acb7b237c3a00bebe54b030f461675ceb570e738743348a889ea3400b7d01e6261edb5d835c4759914960ae29cbba98a00a6

    • SSDEEP

      3072:4+1ksmuRo+BmpH7Rx/inqhzlE0EP5vdRGXVIJeouw:2sHbmpRgnqhzPEP5vbGXiuw

    Score
    10/10
    executionstrratdiscoverypersistencestealertrojan

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

      trojanstealerstrrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks