MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10
SHA3-384 hash:	362e71e27a2ecbe056ebd785d8422a6c5c80788413d97b2ae583ac7f96c7579626b6ab15cb4f3e0f63d7de4854d712bf
SHA1 hash:	55134d1b471873fc23f218116fed9def4e600a14
MD5 hash:	a525cd786d7fee35ba4a2a0f2ea4ed13
humanhash:	xray-pasta-oscar-robin
File name:	SWIFT.jar
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	214'448 bytes
First seen:	2024-03-05 08:15:37 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	6144:kEq8dJWHf/lT5xqQzyjRhcV7FaVjuFPIVmyKH:kEjdo37EQ8q7FaVeYKH
TLSH	T17024016A2F82D0B9C20751760604A27FB718438CD684DA1FABEC69266D35DBD1707ECF
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	jar STRRAT

abuse_ch

STRRAT C2:
103.151.123.225:7800

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

129

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN strrat

Malware family:

strrat

Alert

Create hunting rule

ID:

1

File name:

03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10.jar

Verdict:

Malicious activity

Analysis date:

2024-03-05 08:17:22 UTC

Tags:

rat strrat evasion remote

Link:

https://app.any.run/tasks/ecfbd7df-ff3e-421e-9413-d227f726e169

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Java.Malware.CVE_2021_44228-9915819-0

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

banload spyagent

Link:

https://www.filescan.io/uploads/65e6d4c5994a0fb4224c3797/reports/557a290f-b4f1-4843-947f-3cb521b76f95/overview

Hybrid Analysis Java.Trojan.Generic.29423;Trojan.Generic.35296277;Trojan.Generic.35296278;Java.Trojan.GenericA.35713;Java.Trojan.GenericA.35715;Java.Trojan.GenericA.35714;Java.Trojan.Generic.29405;Trojan.Generic.35298332;Java.Trojan.GenericA.35712;Java.Trojan.GenericA

Verdict:

Malicious

Labled as:

Java.Trojan.Generic.29423;Trojan.Generic.35296277;Trojan.Generic.35296278;Java.Trojan.GenericA.35713;Java.Trojan.GenericA.35715;Java.Trojan.GenericA.35714;Java.Trojan.Generic.29405;Trojan.Generic.35298332;Java.Trojan.GenericA.35712;Java.Trojan.GenericA

Link:

https://www.hybrid-analysis.com/sample/03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.expl

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1403225

Signature

Antivirus detection for URL or domain

Exploit detected, runtime environment starts unknown processes

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03e4c903cc2cbe8854e6af1bd5e741d88da5c35732c7b051215ecf9d6be10c10/

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.StrRat

Threat name:

ByteCode-JAVA.Trojan.StrRat

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-05 08:16:06 UTC

File Type:

Binary (Archive)

Extracted files:

76

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=apsmsa6mfs7iqvhgv4n5lz2b3cg2lq2xgld3aujbl3hz227bbqia._file

Hatching Triage strrat

Result

Malware family:

strrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:strrat discovery

Link:

https://tria.ge/reports/240305-j548ksbb95/

Behaviour

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Modifies file permissions

Malware Config

C2 Extraction:

jugoken567.ddns.net:7800
103.151.123.225:7800

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.