MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 5


Intelligence 5 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9
SHA3-384 hash: 91cb6bf3a64e7f8ab010ed0552ad4720307ffd2ea67025e4c65cf609ef3dc10fde307dde242514019f3fd2658ebd864f
SHA1 hash: 62058bd9d3683d7a6983d36722fede080b87c3d3
MD5 hash: 9f431f7105d073752fd396105dc898ef
humanhash: connecticut-mars-rugby-romeo
File name:doc20210812876462PDF.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:96'727 bytes
First seen:2021-08-12 06:36:55 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 1536:Ex4jk2LwtGGBCRLwZ0MQ6i98iZGmAT5hSXx93uf3gdTsypX7GufP16wzInBvOwv:VjLwtGLi0MQ6iS8ATo9efwfplP11zC
TLSH T10993D00BBDA6D9E5D50F96764088F937650C418EFE44A62B18FD4C8B5C72C790712E8F
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
79.134.225.26:7888

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.26:7888 https://threatfox.abuse.ch/ioc/173393/

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
doc20210812876462PDF.jar
Verdict:
No threats detected
Analysis date:
2021-08-12 07:18:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1dade4d7-1a9e-4971-aa12-7fa369408764

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/178484/
Detection(s):
SecuriteInfo.com.UDS.Trojan.Java.Agent.gen.31858.8421.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/831505
Signature
Creates autostart registry keys to launch java
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
May check the online IP address of the machine
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463951 Sample: doc20210812876462PDF.jar Startdate: 12/08/2021 Architecture: WINDOWS Score: 76 62 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->62 64 Yara detected STRRAT 2->64 66 May check the online IP address of the machine 2->66 68 2 other signatures 2->68 10 cmd.exe 2 2->10         started        13 javaw.exe 2->13         started        process3 signatures4 72 Uses schtasks.exe or at.exe to add and modify task schedules 10->72 15 java.exe 29 10->15         started        18 conhost.exe 10->18         started        process5 dnsIp6 56 github.com 140.82.121.3, 443, 49728 GITHUBUS United States 15->56 58 github-releases.githubusercontent.com 185.199.108.154, 443, 49730 FASTLYUS Netherlands 15->58 60 3 other IPs or domains 15->60 20 java.exe 4 15->20         started        22 icacls.exe 1 15->22         started        process7 process8 24 java.exe 2 22 20->24         started        28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        file9 48 C:\Users\user\...\doc20210812876462PDF.jar, Zip 24->48 dropped 50 C:\Users\user\...\jna3250539970252467321.dll, PE32 24->50 dropped 70 Creates autostart registry keys to launch java 24->70 32 java.exe 14 24->32         started        36 cmd.exe 1 24->36         started        38 conhost.exe 24->38         started        signatures10 process11 dnsIp12 52 79.134.225.26, 49751, 7888 FINK-TELECOM-SERVICESCH Switzerland 32->52 54 ip-api.com 208.95.112.1, 49756, 80 TUT-ASUS United States 32->54 46 C:\Users\user\...\jna1023461298584072475.dll, PE32 32->46 dropped 40 conhost.exe 32->40         started        42 conhost.exe 36->42         started        44 schtasks.exe 36->44         started        file13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9/
Threat name:
ByteCode-JAVA.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-08-12 06:37:17 UTC
AV detection:
1 of 46 (2.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=glf42y3lgkk3pgds3sed7bf5hrptpd46fpleu4yur2fd2xlnld4q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210812-rljwz1mv56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/178484/

Comments