MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4
SHA3-384 hash:	5488499e79f04a6590ca975980fd47971b1216fcbebfe90015c429ad6b09037f972a80cc1d721697012ccd7b68f1a893
SHA1 hash:	9f788fe6b218a0441301f75a835aaa3fbf01a21a
MD5 hash:	e99af34d39ecc884ec19065386dae4e5
humanhash:	emma-aspen-mountain-leopard
File name:	RFQ7586281.jar
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	223'916 bytes
First seen:	2023-05-22 05:55:20 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	3072:ZrnBhP3M/HPX9xxQD5gBb5F6MiIUI3WpzUpLH4lqA8t8H12vzBtPPs0Pml:Zrn/P8vPX9xxg5CRi43WpwZ4lqbvNPK
TLSH	T1B524016EB9DD94AAE91BE632058997364A0E2284D549F37B30FC14194F70C2F0F5A9CF
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	jar STRRAT

abuse_ch

STRRAT C2:
194.87.151.236:8232

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

136

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN strrat

Malware family:

strrat

Alert

Create hunting rule

ID:

1

File name:

RFQ7586281.jar

Verdict:

Malicious activity

Analysis date:

2023-05-22 05:55:37 UTC

Tags:

rat strrat evasion

Link:

https://app.any.run/tasks/538a4487-25d4-4965-ba18-9cdd96d29ce2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Java.Siggen.525.13269.5234.UNOFFICIAL

Alert

Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

banload spyagent

Link:

https://www.filescan.io/uploads/646b03f588c7ea565ca3acd5/reports/ada094cc-95bf-4014-b589-9360cf458a02/overview

Hybrid Analysis Exploit.Zip.Heuristic

Verdict:

Malicious

Labled as:

Exploit.Zip.Heuristic

Link:

https://www.hybrid-analysis.com/sample/3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.expl

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1239340

Signature

Exploit detected, runtime environment starts unknown processes

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4/

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.Strrat

Threat name:

ByteCode-JAVA.Trojan.Strrat

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-22 05:17:35 UTC

File Type:

Binary (Archive)

Extracted files:

76

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gft4wg4vtnx5txai2yoi3muku6d3bqln2cay7uoxp64zkhcwklsa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/230522-gm1rbsed22/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/3167cb1b959b6fd9dc08d61c8db28aa787b0c16dd0818fd1d77fb9951c5652e4