MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 009033a7c6762dfd9f4aceab9eba3241b50491d0d3cff02ca8f6991a0814d4c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 009033a7c6762dfd9f4aceab9eba3241b50491d0d3cff02ca8f6991a0814d4c8
SHA3-384 hash: e722bc0b570f27fe1d3c70d4f87ce69c740cc9beed7dc18a6fd42a577b90649798b91151bed3de0b16bc8de50da050a7
SHA1 hash: bfe1d108798004af37f8b1d8dcbc4711634cfbab
MD5 hash: c7adcd12631227ed62d6ab3c995eff01
humanhash: indigo-uniform-december-texas
File name:PO-3345#.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:105'001 bytes
First seen:2021-08-26 13:16:51 UTC
Last seen:2021-08-26 21:22:54 UTC
File type:Java file jar
MIME type:application/zip
ssdeep 3072:u5oRowGq8d2X2BW68jzQ8qxwXccO309FWj7:lqnqVmBL8jQm1OE90j7
TLSH T1D4A3E02FAE99D6F4D5875532101C82A3EB1C62CDD50AA12F20FC54460E79CBE1B4ABDF
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
103.156.90.52:4292

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
103.156.90.52:4292 https://threatfox.abuse.ch/ioc/198178/

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO-3345#.jar
Verdict:
No threats detected
Analysis date:
2021-08-26 13:21:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f791207f-4872-4629-94ca-9430d4e8bcb4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182659/
Detection(s):
SecuriteInfo.com.Java.Trojan.GenericGB.29244.7432.7862.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/839794
Signature
Creates autostart registry keys to launch java
Creates autostart registry keys with suspicious names
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
May check the online IP address of the machine
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 472224 Sample: PO-3345#.jar Startdate: 26/08/2021 Architecture: WINDOWS Score: 84 68 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->68 70 Yara detected STRRAT 2->70 72 May check the online IP address of the machine 2->72 74 3 other signatures 2->74 10 cmd.exe 2 2->10         started        13 javaw.exe 2->13         started        process3 signatures4 76 Uses schtasks.exe or at.exe to add and modify task schedules 10->76 15 java.exe 29 10->15         started        19 conhost.exe 10->19         started        process5 dnsIp6 62 github.com 140.82.121.3, 443, 49710 GITHUBUS United States 15->62 64 github-releases.githubusercontent.com 185.199.108.154, 443, 49711 FASTLYUS Netherlands 15->64 66 2 other IPs or domains 15->66 48 C:\cmdlinestart.log, ASCII 15->48 dropped 21 java.exe 4 15->21         started        23 icacls.exe 1 15->23         started        file7 process8 process9 25 java.exe 2 22 21->25         started        30 conhost.exe 21->30         started        32 conhost.exe 23->32         started        dnsIp10 60 192.168.2.1 unknown unknown 25->60 52 C:\Users\user\AppData\Roaming\PO-3345#.jar, Zip 25->52 dropped 54 C:\Users\user\...\jna3055524542383682727.dll, PE32 25->54 dropped 78 Creates autostart registry keys to launch java 25->78 80 Creates autostart registry keys with suspicious names 25->80 34 java.exe 14 25->34         started        38 cmd.exe 1 25->38         started        40 conhost.exe 25->40         started        file11 signatures12 process13 dnsIp14 56 103.156.90.52, 4292, 49720 TWIDC-AS-APTWIDCLimitedHK unknown 34->56 58 ip-api.com 208.95.112.1, 49721, 80 TUT-ASUS United States 34->58 50 C:\Users\user\...\jna4073510474955395499.dll, PE32 34->50 dropped 42 conhost.exe 34->42         started        44 conhost.exe 38->44         started        46 schtasks.exe 38->46         started        file15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/009033a7c6762dfd9f4aceab9eba3241b50491d0d3cff02ca8f6991a0814d4c8/
Threat name:
ByteCode-JAVA.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 13:17:24 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=acidhj6goyw73h2kz2vz5orsig2qjeoq2ph7alfi62mrucau2tea._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210826-wjlmld18en/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/009033a7c6762dfd9f4aceab9eba3241b50491d0d3cff02ca8f6991a0814d4c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/182659/

Comments