MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 214243e2fbe341f26e81a4a4ac5d407893a756bbb83c40d63ca6c76e419215a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 214243e2fbe341f26e81a4a4ac5d407893a756bbb83c40d63ca6c76e419215a4
SHA3-384 hash: ef6f305dec1a0806a4bc375458279866ca67f38e8b497ed01511fd42364d59a06b15eeb7ddbf27b9282497f0b17aad07
SHA1 hash: fefe60fb73ceb0d828356a5e14dd92aa0472448b
MD5 hash: 945f4e614159d3761b358d908dfddd2f
humanhash: jersey-chicken-snake-fruit
File name:paket..jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:94'794 bytes
First seen:2021-10-25 20:33:19 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 1536:JQ/x1A3AP1j9Q31+jYicDjnGS4Psi+Z0IpL42jvTD5XheJfsHGvAvxVpEHruL5:JQ83AP1RQojMGtPz+uI942bTGJfFvpLY
TLSH T10F93BF6B387BC078D2031933506985236A2D969FD54D613B2BFC0462BE34D6EAB176CF
Reporter neoxmorpheus1
Tags:jar STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
378
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200015/
Detection(s):
SecuriteInfo.com.Java.Siggen.498.18366.14673.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
50%
Tags:
banload strrat
Link:
https://www.filescan.io/uploads/617714bd9a5a1e91c5d2ebbd/reports/73d96bc5-15fe-4865-b8e8-42155044653a/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/214243e2fbe341f26e81a4a4ac5d407893a756bbb83c40d63ca6c76e419215a4
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/876604
Signature
Found detection on Joe Sandbox Cloud Basic with higher score
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 509036 Sample: paket..jar Startdate: 25/10/2021 Architecture: WINDOWS Score: 68 30 sonatype.map.fastly.net 2->30 32 repo1.maven.org 2->32 34 github.com 2->34 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected STRRAT 2->44 46 Found detection on Joe Sandbox Cloud Basic with higher score 2->46 48 Yara detected AllatoriJARObfuscator 2->48 9 cmd.exe 2 2->9         started        12 cmd.exe 1 2->12         started        signatures3 process4 file5 28 C:\cmdlinestart.log, ASCII 9->28 dropped 14 java.exe 23 9->14         started        17 conhost.exe 9->17         started        19 7za.exe 76 12->19         started        process6 dnsIp7 36 github.com 140.82.121.3, 443, 49757, 49761 GITHUBUS United States 14->36 38 140.82.121.4, 443, 49842, 49846 GITHUBUS United States 14->38 40 3 other IPs or domains 14->40 22 icacls.exe 1 14->22         started        26 C:\jar\carLambo\y.class, compiled 19->26 dropped file8 process9 process10 24 conhost.exe 22->24         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/214243e2fbe341f26e81a4a4ac5d407893a756bbb83c40d63ca6c76e419215a4/
Threat name:
ByteCode-JAVA.Trojan.StrRat
Create hunting rule
Status:
Malicious
First seen:
2021-10-25 06:26:47 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer suricata trojan
Link:
https://tria.ge/reports/211025-zce1zshebm/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
STRRAT
suricata: ET MALWARE STRRAT CnC Checkin
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/214243e2fbe341f26e81a4a4ac5d407893a756bbb83c40d63ca6c76e419215a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200015/

Comments