MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ba74a172f8161a4f7f8846f56be2ee9bdd311dd3ef7cece864908ff0b7f21a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6ba74a172f8161a4f7f8846f56be2ee9bdd311dd3ef7cece864908ff0b7f21a3
SHA3-384 hash:	bcdc62e19af49be50fd31765dee81dc59ee4af48a7aaec56ae091d474d99516f58731afde89bf116edf298489833a93c
SHA1 hash:	edaf79e3df651d1f1bc1125ec93196bf10c4bc55
MD5 hash:	bc59a811ddcf2362df32c2d210766d14
humanhash:	wyoming-snake-johnny-solar
File name:	AWB #2145499215.pdf.jar
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	214'072 bytes
First seen:	2023-05-23 06:20:18 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	3072:W4vaCMbSAWmbXellPjGhl3cti6t41Dcg/yB0lYLiHQgpIajilPFCyuL5mDLx:++mTWVAlCi6t41MBLKIl9FJu4Z
TLSH	T1A224010FBD87E1B8D54369F54510D63F98DE81A8E056A15B28FC64DA4EB1C891F02ECE
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	jar STRRAT

abuse_ch

STRRAT C2:
185.252.179.108:1788

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

148

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN strrat

Malware family:

strrat

Alert

Create hunting rule

ID:

1

File name:

AWB #2145499215.pdf.jar

Verdict:

Malicious activity

Analysis date:

2023-05-23 06:23:40 UTC

Tags:

rat strrat evasion

Link:

https://app.any.run/tasks/b58789da-7a04-4863-85db-2fe1e99ac338

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Java.Malware.CVE_2021_44228-9915819-0

Alert

Create hunting rule

MiscreantPunch.Jsocket.RAT.11162016.2.UNOFFICIAL

Alert

Create hunting rule

PUA.Java.Packer.Allatori-1

Alert

Create hunting rule

SecuriteInfo.com.Java.Siggen.525.13269.5234.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

banload spyagent

Link:

https://www.filescan.io/uploads/646c5b4fa3b73c923e76bb09/reports/40ef65f6-7328-4d9c-a2d8-2e67963c8b7a/overview

Hybrid Analysis Exploit.Zip.Heuristic

Verdict:

Malicious

Labled as:

Exploit.Zip.Heuristic

Link:

https://www.hybrid-analysis.com/sample/6ba74a172f8161a4f7f8846f56be2ee9bdd311dd3ef7cece864908ff0b7f21a3

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.expl

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1240523

Signature

Exploit detected, runtime environment starts unknown processes

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ba74a172f8161a4f7f8846f56be2ee9bdd311dd3ef7cece864908ff0b7f21a3/

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.StrRat

Threat name:

ByteCode-JAVA.Trojan.StrRat

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-23 04:14:16 UTC

File Type:

Binary (Archive)

Extracted files:

76

AV detection:

13 of 23 (56.52%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=notuufzpqfq2j57yqrxvnpro5g65geo5h3345tugjeep6c37egrq._file

Hatching Triage strrat

Result

Malware family:

strrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:strrat persistence stealer trojan

Link:

https://tria.ge/reports/230523-g4bhrseh8x/

Behaviour

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Adds Run key to start application

Looks up external IP address via web service

Drops startup file

Loads dropped DLL

STRRAT

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6ba74a172f8161a4f7f8846f56be2ee9bdd311dd3ef7cece864908ff0b7f21a3