MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57fe225cc662f4dd01e48d23463eebc6150006715bd51e1f433dd59342634f69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57fe225cc662f4dd01e48d23463eebc6150006715bd51e1f433dd59342634f69
SHA3-384 hash: 8248e9488702881cfca7f4a7bebf9d7ac6f29ee715ccd1c6f52c8277fdc007d8fecad6dff005ca8c50b31f16a3d94dc7
SHA1 hash: 32fd28d54d0328df820941a63e240bb953b150cd
MD5 hash: 7f26cb98687ec04e56bc182c457b1265
humanhash: harry-california-victor-enemy
File name:Machine Info.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:168'740 bytes
First seen:2022-05-09 16:48:33 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:5gu3EVKMoRX+gSlmm3Ni1RW3Cfwc0Y//9y2rT3GR2bTD7BDRGh+GvWDHN:5gu0VKMWCNibWSf70Y3VrrGk/DPBt
TLSH T135F3F15B7EAAC1F4D4E3803B21A192A3D54D1294D203C09F71EC459A5C76CAE2B4BECF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter proxylife
Tags:jar STRRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
23.227.196.162:7456 https://threatfox.abuse.ch/ioc/549294/

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
Machine Info.jar
Verdict:
Malicious activity
Analysis date:
2022-05-09 16:59:32 UTC
Tags:
evasion trojan strrat rat
Link:
https://app.any.run/tasks/19e516c7-47ec-484d-b931-fff4cbd090ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62794607bd5c76586e259a26/reports/fdf18c94-182c-4e8d-96a0-f270983598d4/overview
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/990380
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 622873 Sample: Machine Info.jar Startdate: 09/05/2022 Architecture: WINDOWS Score: 64 25 Found malware configuration 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected STRRAT 2->29 8 cmd.exe 2 2->8         started        10 cmd.exe 1 2->10         started        process3 process4 12 java.exe 5 8->12         started        15 conhost.exe 8->15         started        17 7za.exe 77 10->17         started        dnsIp5 23 192.168.2.1 unknown unknown 12->23 19 icacls.exe 1 12->19         started        process6 process7 21 conhost.exe 19->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57fe225cc662f4dd01e48d23463eebc6150006715bd51e1f433dd59342634f69/
Threat name:
ByteCode-JAVA.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2022-05-09 16:49:08 UTC
File Type:
Binary (Archive)
Extracted files:
70
AV detection:
11 of 26 (42.31%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k77cexggml2n2aperurumpxlyykqabtrlpkr4h2dhxkzgqtdj5uq._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer trojan
Link:
https://tria.ge/reports/220509-vbnjhsdgd4/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Adds Run key to start application
Drops startup file
STRRAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/57fe225cc662f4dd01e48d23463eebc6150006715bd51e1f433dd59342634f69

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments