🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a802b9ac459cb8a31954ef86cc6c946d2b36e9bec43fa949824e1ff33f685edc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a802b9ac459cb8a31954ef86cc6c946d2b36e9bec43fa949824e1ff33f685edc
SHA3-384 hash: ebcaa57bccd5e371f278571fc7479bfd24365079c2ec82fa601254e45d855bd70d280d006d677b0ad9b48906cad89c12
SHA1 hash: f6ab74bab83e33cfb2b7420b6b39a779be9ff5ef
MD5 hash: 29bcfbca9c106055bf154c432b4a50d8
humanhash: louisiana-louisiana-fruit-william
File name:DHLMar 2021 at 4.508BZ290PDF.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:172'990 bytes
First seen:2021-03-31 08:05:51 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:OWaBZzMjdKKdqqNNURp3s2HBJvT8jLX9VzBWptVmMAOjBAkHA1pvsvps5voy318E:A5MZKKd0siJvT89VzQpt4ABAk0Ups5wu
TLSH 60F323E4A49805E2CD6DF16C60C686B28D7746CBB726FFB74E34B344046171ECB9A9C2
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
103.133.109.176:9123

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
103.133.109.176:9123 https://threatfox.abuse.ch/ioc/6188/

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHLMar 2021 at 4.508BZ290PDF.jar
Verdict:
No threats detected
Analysis date:
2021-03-31 08:13:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/707302ac-a5eb-4045-970d-72dc58a156ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/129226/
Detection(s):
SecuriteInfo.com.Adwind-FDYD.jar2A88CEB4DFE0.31858.23989.UNOFFICIAL
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/659923
Signature
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Get antivirus details via WMIC query
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AllatoriJARObfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 378890 Sample: DHLMar 2021 at 4.508BZ290PDF.jar Startdate: 31/03/2021 Architecture: WINDOWS Score: 100 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Multi AV Scanner detection for domain / URL 2->85 87 Multi AV Scanner detection for submitted file 2->87 89 6 other signatures 2->89 12 cmd.exe 2 2->12         started        14 notepad.exe 2->14         started        16 notepad.exe 2->16         started        18 notepad.exe 2->18         started        process3 process4 20 java.exe 6 12->20         started        22 conhost.exe 12->22         started        process5 24 wscript.exe 2 20->24         started        26 icacls.exe 1 20->26         started        process6 28 javaw.exe 26 24->28         started        31 conhost.exe 26->31         started        dnsIp7 77 github.com 140.82.121.4, 443, 49703 GITHUBUS United States 28->77 79 github-releases.githubusercontent.com 185.199.108.154, 443, 49706 FASTLYUS Netherlands 28->79 81 3 other IPs or domains 28->81 33 java.exe 2 21 28->33         started        process8 file9 67 C:\Users\user\AppData\Roaming\kalnaurwj.txt, Zip 33->67 dropped 69 C:\Users\user\...\jna5323199673121321847.dll, PE32 33->69 dropped 36 java.exe 33->36         started        40 conhost.exe 33->40         started        process10 dnsIp11 73 103.133.109.176, 49717, 49733, 9123 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN Viet Nam 36->73 75 ip-api.com 208.95.112.1, 49721, 80 TUT-ASUS United States 36->75 71 C:\Users\user\...\jna2320603262604124703.dll, PE32 36->71 dropped 42 cmd.exe 36->42         started        44 cmd.exe 36->44         started        46 cmd.exe 36->46         started        48 2 other processes 36->48 file12 process13 process14 50 WMIC.exe 42->50         started        53 conhost.exe 42->53         started        55 conhost.exe 44->55         started        57 WMIC.exe 44->57         started        59 conhost.exe 46->59         started        61 WMIC.exe 46->61         started        63 conhost.exe 48->63         started        65 WMIC.exe 48->65         started        signatures15 91 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 50->91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a802b9ac459cb8a31954ef86cc6c946d2b36e9bec43fa949824e1ff33f685edc/
Threat name:
Archive-JAR.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 08:06:06 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vabltlcfts4kggku56dmy3eunuvtn2n6yq72ssmcjyp7gp3il3oa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210331-tbkfnqvb5n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/a802b9ac459cb8a31954ef86cc6c946d2b36e9bec43fa949824e1ff33f685edc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/129226/

Comments