MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 811779e606a2e6db9538de49d0edeacfd28131e42dde09f4e09e7ae07cb21194. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 811779e606a2e6db9538de49d0edeacfd28131e42dde09f4e09e7ae07cb21194
SHA3-384 hash: 03bae8e75d70318d77fd1f2cccce70c96c649b9210a57e6f82cbea6d5d95e8c82296779c27a21270f9484381f8d6e41b
SHA1 hash: d0e889cf26a8668360e739f46464a1059307a5ad
MD5 hash: 866776e45f1cfa857d7550a4266e4e4e
humanhash: mockingbird-carpet-mexico-pip
File name:RES0.08-1800 Richardson Electronics.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:224'707 bytes
First seen:2023-03-15 08:40:17 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 6144:Ol/yjllYjJ1WfxCkI6UJTefAl/aXboF2cHim0KhA:SUfxC7xefuwvEhe
TLSH T1FE24029AADABA1E4E44B203B0248C277970D519CD466593F59FC09AB0E70D5B4D03BFF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
95.214.27.146:4333

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
RES0.08-1800 Richardson Electronics.jar
Verdict:
Malicious activity
Analysis date:
2023-03-15 08:41:44 UTC
Tags:
rat strrat evasion
Link:
https://app.any.run/tasks/d0e1d291-6288-4059-9999-a3c72be7763a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/374490/
Detection(s):
SecuriteInfo.com.Java.Siggen.525.13269.5234.UNOFFICIAL
Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/641184a006c49bd8b6b5e753/reports/ca51c9cd-6400-4093-a35f-ec1340d46fc1/overview
Verdict:
Suspicious
Labled as:
Exploit.Zip.Heuristic
Link:
https://www.hybrid-analysis.com/sample/811779e606a2e6db9538de49d0edeacfd28131e42dde09f4e09e7ae07cb21194
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1193982
Signature
Exploit detected, runtime environment starts unknown processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 826883 Sample: RES0.08-1800_Richardson_Ele... Startdate: 15/03/2023 Architecture: WINDOWS Score: 72 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected STRRAT 2->26 28 2 other signatures 2->28 7 java.exe 5 2->7         started        10 7za.exe 82 2->10         started        process3 dnsIp4 20 192.168.2.1 unknown unknown 7->20 12 icacls.exe 1 7->12         started        14 conhost.exe 7->14         started        16 conhost.exe 10->16         started        process5 process6 18 conhost.exe 12->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/811779e606a2e6db9538de49d0edeacfd28131e42dde09f4e09e7ae07cb21194/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qelxtzqgultnxfjy3ze5b3pkz7jicmpefxpat5hatz5oa7fscgka._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer trojan
Link:
https://tria.ge/reports/230315-klfasacd25/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
STRRAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
STRRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/811779e606a2e6db9538de49d0edeacfd28131e42dde09f4e09e7ae07cb21194

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/374490/

Comments