MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff
SHA3-384 hash: 60e5ddcf93135150cceb5694839d8ef7ec3f177a4180c7640f4720fcb1de267ff193d88f465c0976a7c9ffe5b287b4d6
SHA1 hash: ab522b31c486b3f66ba4eeff7f17ee41448d7e6f
MD5 hash: f69c526b77f850f55716e46c17571579
humanhash: ceiling-black-skylark-edward
File name:TEKLIF-FORMU.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:98'442 bytes
First seen:2026-08-21 09:13:12 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 1536:nBoy3hI8QVzCjYFR+eM7OZJJsKvG6xWXqOUoMcEL:nq0IfRLoX7uJHx2PvMcEL
TLSH T181A308406A54907AF663F0770B58D22FAD7CF8EFD254E28B0EF1AC9CDC698490F52685
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter lowmal3
Tags:jar STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82357/
Detection(s):
TwinWave.EvilJAR.e_STRRAT_Shuffle.20240412.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27013.JsHeur.Obfs.UNOFFICIAL
Create hunting rule

PUA.Java.Packer.Allatori-1
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a8816ab7aeb8a4a7bfd88c3/reports/1d65cff4-0d10-4526-9711-cc5fdc6a7931/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff
Result
Threat name:
Caesium Obfuscator
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1961694
Signature
Multi AV Scanner detection for submitted file
Yara detected Caesium Obfuscator
Behaviour
Behavior Graph:
Download SVG
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff/
Threat name:
ByteCode-JAVA.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-20 01:38:10 UTC
File Type:
Binary (Archive)
Extracted files:
162
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oj4fzb7sbjtwuyus5oiyv6qh5mkqcfynwxodlgbvpkkpy57npd7q._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat discovery execution persistence privilege_escalation stealer trojan
Link:
https://tria.ge/reports/260821-k6vk7sbn8z/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes a command shell one-liner
Adds Run key to start application
Looks up external IP address via web service
Creates a file in the Startup directory
Family: STRRAT
Malware Config
C2 Extraction:
elastsolek.duckdns.org:4778
zekeriyasolek44.duckdns.org:4778
Malware family:
STRRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/72785c87f20a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/72785c87f20a676a6292eb918afa07eb1501170db5dc3598357a94fc77ed78ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:STRRAT
Create hunting rule
Author:NDA0E
Description:Detects STRRAT config filename
Rule name:strrat_jar_v1
Create hunting rule
Author:RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82357/

Comments