🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07d0489f3c290e0a325a52307390555c3ed97bce184d9383c3dc4e56b9c2f3f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 7


Intelligence 7 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07d0489f3c290e0a325a52307390555c3ed97bce184d9383c3dc4e56b9c2f3f0
SHA3-384 hash: dd2756f62859e32437411e1cc2a8f0d43f19eba8620a80435de97e5adf526bc3af349e9ce81d21c1026917dc3bc54b53
SHA1 hash: faabdd81222cd8577ff1ad690326c5fc34c7c2de
MD5 hash: b0c420b3d6578343be22df3d61cef16a
humanhash: bakerloo-timing-blossom-magazine
File name:05_extracted.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:90'597 bytes
First seen:2021-09-14 13:12:25 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 1536:vQB7oGYSbJrjIahaB7CdfRSWVFXUmuqUt8mSYsZuHXuO8JNUgan:vgjhnPXnuqUKupuO8JNGn
TLSH T1E993CE2F3DD699A6C0075932194CC2F2EA8D45D8D51FA81F68FC66871E74E6C0B06E8F
Reporter Racco42
Tags:jar STRRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.98.202.98:7123 https://threatfox.abuse.ch/ioc/221793/

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
05_extracted.jar
Verdict:
Malicious activity
Analysis date:
2021-09-14 13:13:01 UTC
Tags:
evasion trojan strrat rat
Link:
https://app.any.run/tasks/d65802ef-540d-41dc-a470-eb9c66e0940c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187818/
Detection(s):
SecuriteInfo.com.Java.Trojan.GenericGBA.29493.7279.28814.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61750f70a9d585e6d5370d7a/reports/7d165fee-b55f-40d3-bccd-644dbaca7ded/overview
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/850709
Signature
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483140 Sample: 05_extracted.jar Startdate: 14/09/2021 Architecture: WINDOWS Score: 60 27 sonatype.map.fastly.net 2->27 29 repo1.maven.org 2->29 31 github.com 2->31 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected STRRAT 2->41 43 Yara detected AllatoriJARObfuscator 2->43 9 cmd.exe 2 2->9         started        11 cmd.exe 1 2->11         started        signatures3 process4 process5 13 java.exe 23 9->13         started        17 conhost.exe 9->17         started        19 7za.exe 70 11->19         started        dnsIp6 33 github.com 140.82.121.3, 443, 49747, 49752 GITHUBUS United States 13->33 35 sonatype.map.fastly.net 199.232.192.209, 443, 49745, 49746 FASTLYUS United States 13->35 37 2 other IPs or domains 13->37 25 C:\cmdlinestart.log, ASCII 13->25 dropped 21 icacls.exe 1 13->21         started        file7 process8 process9 23 conhost.exe 21->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07d0489f3c290e0a325a52307390555c3ed97bce184d9383c3dc4e56b9c2f3f0/
Threat name:
ByteCode-JAVA.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2021-09-14 13:13:05 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a7ierhz4fehaums2kiyhhecvlq7ns66odbgzha6d3rhfnooc6pya._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210914-qf3f1sfgc8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/07d0489f3c290e0a325a52307390555c3ed97bce184d9383c3dc4e56b9c2f3f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/187818/

Comments