MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53f780bac1bebfe9e1c319e4094cba3a9f4e443dbedb526f7c982d1bf9bedc6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53f780bac1bebfe9e1c319e4094cba3a9f4e443dbedb526f7c982d1bf9bedc6a
SHA3-384 hash: eaf6bf62e4b96bce03b1d198c5cffad5d4ab6bfc940f5b469add8f98c143c49e3b9bea00c498f1268adbfdfe63a00022
SHA1 hash: 44b24c44d0249351ecef829b8a0824ed673f23be
MD5 hash: 312871494d238eca69fa76b287737772
humanhash: quiet-bravo-virginia-cat
File name:SwiftBarclaysSS-24Orderequipmentsexportexwork.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:223'254 bytes
First seen:2023-10-10 19:56:08 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 6144:7xvTBx2XDeMr+uJv1XHVMyyGUyOsR3V9Bb:7pTWXD7JJdX1Myy0OSV9Bb
TLSH T14024024FFE9FC4F6C10BA6321185802A955CE2DCE285956B25FDA85A8C71F2E07079CF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
185.222.58.235:6604

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
SwiftBarclaysSS-24Orderequipmentsexportexwork.jar
Verdict:
Malicious activity
Analysis date:
2023-10-10 19:58:39 UTC
Tags:
rat strrat evasion remote
Link:
https://app.any.run/tasks/01fa2432-8743-44ef-aabe-4e9ecdd41950

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/452995/
Detection(s):
SecuriteInfo.com.Java.Siggen.525.13269.5234.UNOFFICIAL
Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Gathering data
Verdict:
Malicious
Labled as:
Exploit.Zip.Heuristic
Link:
https://www.hybrid-analysis.com/sample/53f780bac1bebfe9e1c319e4094cba3a9f4e443dbedb526f7c982d1bf9bedc6a
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1323249
Signature
Antivirus detection for URL or domain
Exploit detected, runtime environment starts unknown processes
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1323249 Sample: SwiftBarclaysSS-24Orderequi... Startdate: 10/10/2023 Architecture: WINDOWS Score: 88 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus detection for URL or domain 2->23 25 4 other signatures 2->25 7 java.exe 9 2->7         started        9 7za.exe 81 2->9         started        process3 process4 11 icacls.exe 1 7->11         started        13 conhost.exe 7->13         started        15 conhost.exe 9->15         started        process5 17 conhost.exe 11->17         started       
Score:
2%
Verdict:
Benign
File Type:
Archive
Link:
https://malprob.io/report/53f780bac1bebfe9e1c319e4094cba3a9f4e443dbedb526f7c982d1bf9bedc6a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53f780bac1bebfe9e1c319e4094cba3a9f4e443dbedb526f7c982d1bf9bedc6a/
Threat name:
ByteCode-JAVA.Trojan.Strrat
Create hunting rule
Status:
Malicious
First seen:
2023-10-10 19:57:06 UTC
File Type:
Binary (Archive)
Extracted files:
76
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kp3ybowbx276tyoddhsastf2hkpu4rb5x3nve334tawrx6n63rva._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat
Link:
https://tria.ge/reports/231010-yn88jage6x/
Behaviour
Drops file in Program Files directory
Malware Config
C2 Extraction:
dogface.casacam.com:6605
dogface55.duckdns.org:6604
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/452995/

Comments