MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00
SHA3-384 hash:	c8125c8f3b596e4b576f7b557756c1c9a1ff468835bf8627dfb02e9ec7492a1553b60496177b8fa26297b852b86f4908
SHA1 hash:	760d09adceeb4903db4130ef0d28654915844d5d
MD5 hash:	ee75fce2158c3587daa560419f122001
humanhash:	oxygen-robert-bulldog-jupiter
File name:	MVO4879773357878.jar
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	112'050 bytes
First seen:	2024-03-29 12:50:15 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	3072:QOOwYuveeNu/6Xy8HZknOZ6Xdbx9kkTrxZKXZnmVOEvIT:KwdveeoiXy8Cny6Nbx9nrxZKJtEvS
TLSH	T163B3CF2EAECFC6B0D04B82728425A167AB5D41B9E143A50F69FD34454E32DBC4B17ACF
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	jar STRRAT

abuse_ch

STRRAT C2:
91.92.253.144:7888

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN strrat

Malware family:

strrat

Alert

Create hunting rule

ID:

1

File name:

88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00.jar

Verdict:

Malicious activity

Analysis date:

2024-03-29 12:50:29 UTC

Tags:

rat strrat evasion remote

Link:

https://app.any.run/tasks/6d039d90-6d55-4cc7-b4c3-9a6ca6749e94

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm cmd explorer fingerprint lolbin schtasks wmic wscript

Link:

https://www.filescan.io/uploads/6606b937ec04992a87d269ec/reports/7d3ba4ff-aaa1-4db1-b5c8-bf683f4caa5a/overview

Hybrid Analysis Trojan.Java.Agent

Verdict:

Malicious

Labled as:

Trojan.Java.Agent

Link:

https://www.hybrid-analysis.com/sample/88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1417504

Signature

Antivirus detection for URL or domain

Exploit detected, runtime environment starts unknown processes

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00/

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.StrRat

Threat name:

ByteCode-JAVA.Trojan.StrRat

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-29 09:02:15 UTC

File Type:

Binary (Archive)

Extracted files:

79

AV detection:

19 of 37 (51.35%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rcu3jt5mlor2im4uf6hu4sesfhyp22kkp6nhrkfwzjomlxczbyaa._file

Hatching Triage strrat

Result

Malware family:

strrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:strrat discovery

Link:

https://tria.ge/reports/240329-p3gmdsha31/

Behaviour

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Modifies file permissions

Malware Config

C2 Extraction:

d4money.dynamic-dns.net:7888
d4money.dynamic-dns.net:7881

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/88a9b4cfac5b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/88a9b4cfac5ba3a433942f8f4e489229f0fd694a7f9a78a8b6ca5cc5dc590e00