MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39b2579e79869bede2ba65366cde7b71a5125a2e96604f29b4107a2ec1137c2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	39b2579e79869bede2ba65366cde7b71a5125a2e96604f29b4107a2ec1137c2c
SHA3-384 hash:	25099c30dbc5d9b6688066ca5a2805255d94059116b34bf291710ca79ccafdcf041ef18527d60429dc0d4e148332d974
SHA1 hash:	c4fd63a731231ff098a46fd8f3b9b677f94e9b5f
MD5 hash:	9b3e70814414ece3b61fbf1bcda91bbd
humanhash:	snake-princess-georgia-king
File name:	QUOTE FOR55665 55228 ISS SINGAPORE.jar
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	224'763 bytes
First seen:	2023-05-08 06:05:31 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	6144:osiNQ+9FfjAwGIuC5bOHsp3d5YtWL/EXSpertsM+b0:osiNV9NNGdWbOM9bYtmeeedU0
TLSH	T14324017F7DABC9B8D19B3439004882229A0806DDD532A67F35FD585A4CF5C6D2B0A2DF
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	jar STRRAT

abuse_ch

STRRAT C2:
84.38.132.108:8232

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN strrat

Malware family:

strrat

Alert

Create hunting rule

ID:

1

File name:

QUOTE FOR55665 55228 ISS SINGAPORE.jar

Verdict:

Malicious activity

Analysis date:

2023-05-08 06:08:25 UTC

Tags:

rat strrat stealer

Link:

https://app.any.run/tasks/433675fe-dec7-45f7-8625-c1a9c894af2a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Strrat

Detection:

Strrat

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/387390/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Java.Siggen.525.13269.5234.UNOFFICIAL

Alert

Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

banload spyagent

Link:

https://www.filescan.io/uploads/6458914b28594fea9adf5421/reports/d5b892b5-d765-422e-ab4e-9adbf1e0e6df/overview

Hybrid Analysis Exploit.Zip.Heuristic

Verdict:

Malicious

Labled as:

Exploit.Zip.Heuristic

Link:

https://www.hybrid-analysis.com/sample/39b2579e79869bede2ba65366cde7b71a5125a2e96604f29b4107a2ec1137c2c

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.expl

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1227977

Signature

Exploit detected, runtime environment starts unknown processes

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39b2579e79869bede2ba65366cde7b71a5125a2e96604f29b4107a2ec1137c2c/

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.AdWind

Threat name:

ByteCode-JAVA.Trojan.AdWind

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-08 05:53:40 UTC

File Type:

Binary (Archive)

Extracted files:

76

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hgzfphtzq2n63yv2mu3gzxt3ogsrewroszqe6knucb5c5qitpqwa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/230508-gtqvpsba41/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/387390/