MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03766f638bf979a74b47a65f3398efdf943f2b84c3a344ee5f22dbb9e67b0bee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03766f638bf979a74b47a65f3398efdf943f2b84c3a344ee5f22dbb9e67b0bee
SHA3-384 hash: 9e31c592bf3c3d6a6a91d6f4162e5497f4860a4b4242f6ca048244f2238b3f1074ca010bc95115675eeb20194f49cb6b
SHA1 hash: 94072e98545ea71cefd2a5b55cb019a362986c79
MD5 hash: 7ba9197a02c3fd7e1405d82fc4d2886f
humanhash: stream-jupiter-solar-island
File name:shipping_info.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:1'169'381 bytes
First seen:2021-12-23 22:49:59 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dA+Vh:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAi
Threatray 6 similar samples on MalwareBazaar
TLSH T163457B2132C79B32D493117155AEA3611A3EEC704B718287729C7B9E2FB27C0A73579B
Reporter Anonymous
Tags:msi STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216046/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61c4fd2d4ab5c44cbf4e8875/reports/96d99fe7-7fe5-41ca-a053-977f42260556/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/03766f638bf979a74b47a65f3398efdf943f2b84c3a344ee5f22dbb9e67b0bee
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/912213
Signature
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544691 Sample: shipping_info.jar Startdate: 23/12/2021 Architecture: WINDOWS Score: 60 27 sonatype.map.fastly.net 2->27 29 repo1.maven.org 2->29 31 github.com 2->31 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected STRRAT 2->41 43 Yara detected AllatoriJARObfuscator 2->43 9 cmd.exe 2 2->9         started        12 cmd.exe 1 2->12         started        signatures3 process4 file5 25 C:\cmdlinestart.log, ASCII 9->25 dropped 14 java.exe 24 9->14         started        17 conhost.exe 9->17         started        19 7za.exe 1 12->19         started        process6 dnsIp7 33 github.com 140.82.121.3, 443, 49745, 49749 GITHUBUS United States 14->33 35 140.82.121.4, 443, 49820, 49831 GITHUBUS United States 14->35 37 2 other IPs or domains 14->37 21 icacls.exe 1 14->21         started        process8 process9 23 conhost.exe 21->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03766f638bf979a74b47a65f3398efdf943f2b84c3a344ee5f22dbb9e67b0bee/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2021-12-22 03:08:19 UTC
File Type:
Binary (Archive)
Extracted files:
170
AV detection:
14 of 43 (32.56%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0b3ec79751b73aa58e7c71e691d970b00f48f6439f3d0067d269fc2ddef16881
STRRAT
34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d
STRRAT
925974d5a370ad4840b444a7709c2640f8ff3113c6cafbc113e8559fdfcf26e7
STRRAT
aecbd5684b044980ef4d172bee9e7dedaf1f387af35129342ed3e205a8b1a70b
STRRAT
b45b0613f994769e460de419e2aac46863e303e833d43369f2647bac3a8260e6
STRRAT
b6079b972c7bfe1b631b7e4776ce306b3cd818e479ca5cf1b53ca4345b4fd854
STRRAT
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/211223-2r96sacehm/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/03766f638bf979a74b47a65f3398efdf943f2b84c3a344ee5f22dbb9e67b0bee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/216046/

Comments