MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0136c69279c46fb87dd8e4b82bd7514aa7385173f64b1304fb5e55542e7c92e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0136c69279c46fb87dd8e4b82bd7514aa7385173f64b1304fb5e55542e7c92e5
SHA3-384 hash: fa3c4db39f959cc556fa55aaad44b16f2de3c48fd904975659089e7e31b06e2ce20b8fd93ac67fd16398c1b9378c9e33
SHA1 hash: 15c61edad5d293e83da9470dbff4c9825c315c22
MD5 hash: ed9b4a64b41115b339be419d98268564
humanhash: arkansas-california-blossom-maine
File name:office_extension.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:445'229 bytes
First seen:2023-07-03 02:41:05 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 12288:McFBkIK+BDnzq4Qx4uvCgkZ9ooNPh3sUCFBkIK+z:McFBkI7pWv4uvbRojBCFBkI7z
TLSH T113942B91E5A7BEE5FE4EED736308DEB924916CFCD707C00A42641EB0D840568EBE5C86
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter 0xSnowl
Tags:jar STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
TH TH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://cdn.discordapp.com/attachments/1105875636293226507/1122136328163823616/copie_de_paiement.jar
Verdict:
No threats detected
Analysis date:
2023-06-26 13:15:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c102c1e2-93f6-4ed6-8301-19b5b4012e82

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/405607/
Detection(s):
SecuriteInfo.com.Java.Siggen.498.17192.21202.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Heur.29443.24263.UNOFFICIAL
Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

SecuriteInfo.com.HTML-12164.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/64a2357b204315fbc16c5d98/reports/bcd0ae8e-0875-42fd-983f-0d0b8ae3bfd3/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/0136c69279c46fb87dd8e4b82bd7514aa7385173f64b1304fb5e55542e7c92e5
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1265418
Signature
Exploit detected, runtime environment starts unknown processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 898448 Sample: office_extension.jar Startdate: 03/07/2023 Architecture: WINDOWS Score: 72 26 Malicious sample detected (through community Yara rule) 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected STRRAT 2->30 32 2 other signatures 2->32 7 java.exe 23 2->7         started        10 7za.exe 135 2->10         started        process3 dnsIp4 20 github.com 140.82.121.4, 443, 49695, 49697 GITHUBUS United States 7->20 22 dualstack.sonatype.map.fastly.net 199.232.192.209, 443, 49692, 49693 FASTLYUS United States 7->22 24 repo1.maven.org 7->24 12 icacls.exe 1 7->12         started        14 conhost.exe 7->14         started        16 conhost.exe 10->16         started        process5 process6 18 conhost.exe 12->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0136c69279c46fb87dd8e4b82bd7514aa7385173f64b1304fb5e55542e7c92e5/
Threat name:
ByteCode-JAVA.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-06-25 01:14:32 UTC
File Type:
Binary (Archive)
Extracted files:
127
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ae3mnetzyrx3q7oy4s4cxv2rjkttqult6zfrgbh3lzkvilt4slsq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230703-c61hfsed88/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/0136c69279c46fb87dd8e4b82bd7514aa7385173f64b1304fb5e55542e7c92e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/405607/

Comments