MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bbb92a61b4f0773ccfea0dfe75ba26fddf5dcdfc6845e59debf6ca4f41c7ff1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bbb92a61b4f0773ccfea0dfe75ba26fddf5dcdfc6845e59debf6ca4f41c7ff1
SHA3-384 hash: 4d108aa55719a63441e077d17e111ce2dd682ff4ab1b6b857c850d4f257c058e70e872648d154be8fee25886ccb66d46
SHA1 hash: 0e4019cd91175e377c40eed33845bd56cd7228db
MD5 hash: 34308a734b9be820091aa6b88a49bad1
humanhash: one-eighteen-jupiter-south
File name:DM0044688 B pdf.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:90'596 bytes
First seen:2021-03-22 17:20:53 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 1536:qQzeoqjSmJjjIGhyB7GZ/FSWVFXUCmyUt8m+UsZuLXuO8dNcgm:qlXxnPXjmyUKuZuO8dN6
TLSH 0493CF1B2DDB95E7C00759331944832AEA0D56E8E63AA81FAAFD45852C74C6C4B07FCF
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
193.218.118.85:8078

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.218.118.85:8078 https://threatfox.abuse.ch/ioc/4416/

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DM0044688 B pdf.jar
Verdict:
Malicious activity
Analysis date:
2021-03-22 17:26:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c599ac81-d62f-4025-a623-2986dae168cb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126015/
Detection(s):
SecuriteInfo.com.Java.Trojan.GenericGBA.29493.7279.28814.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/648235
Signature
Creates autostart registry keys to launch java
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 373082 Sample: DM0044688 B pdf.jar Startdate: 22/03/2021 Architecture: WINDOWS Score: 68 66 Yara detected STRRAT 2->66 68 Exploit detected, runtime environment starts unknown processes 2->68 70 Exploit detected, runtime environment dropped PE file 2->70 72 Yara detected AllatoriJARObfuscator 2->72 9 cmd.exe 2 2->9         started        12 javaw.exe 2 2->12         started        14 javaw.exe 2->14         started        16 2 other processes 2->16 process3 signatures4 74 Uses schtasks.exe or at.exe to add and modify task schedules 9->74 18 java.exe 29 9->18         started        22 conhost.exe 9->22         started        process5 dnsIp6 54 github.com 140.82.121.4, 443, 49711 GITHUBUS United States 18->54 56 github-releases.githubusercontent.com 185.199.110.154, 443, 49712 FASTLYUS Netherlands 18->56 58 3 other IPs or domains 18->58 46 C:\cmdlinestart.log, ASCII 18->46 dropped 24 java.exe 2 22 18->24         started        28 icacls.exe 1 18->28         started        file7 process8 file9 48 C:\Users\user\AppData\...\DM0044688 B pdf.jar, Zip 24->48 dropped 50 C:\Users\user\...\jna8333605167217933604.dll, PE32 24->50 dropped 76 Creates autostart registry keys to launch java 24->76 30 java.exe 14 24->30         started        34 cmd.exe 1 24->34         started        36 conhost.exe 24->36         started        38 conhost.exe 28->38         started        signatures10 process11 dnsIp12 60 185.136.170.108, 49726, 49730, 49738 VELIANET-ASvelianetInternetdiensteGmbHDE United Kingdom 30->60 62 193.218.118.85, 8078 EPINATURAUA Ukraine 30->62 64 str-master.pw 30->64 52 C:\Users\user\...\jna2327666077860451848.dll, PE32 30->52 dropped 40 conhost.exe 30->40         started        42 conhost.exe 34->42         started        44 schtasks.exe 1 34->44         started        file13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bbb92a61b4f0773ccfea0dfe75ba26fddf5dcdfc6845e59debf6ca4f41c7ff1/
Threat name:
ByteCode-JAVA.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-22 17:21:06 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bo5zfjq3j4dxhth6udp6ow5cn7o7lxg7y2cf4wo6x5wkj5a4p7yq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210322-3bd1xccxss/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bbb92a61b4f0773ccfea0dfe75ba26fddf5dcdfc6845e59debf6ca4f41c7ff1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126015/

Comments