🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad91a7882b4c131aa764d6072fd13e2974abcd95dd8fac166b01316813948274. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 5


Intelligence 5 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad91a7882b4c131aa764d6072fd13e2974abcd95dd8fac166b01316813948274
SHA3-384 hash: 5c5fda27873ad88d09905f830c0e1148f3984001af251523cd4ada60486366a8eb6cf8424ca6bed0c366bbdee888b113
SHA1 hash: 45b5e2050140b29c018429ab004d3645e732c17e
MD5 hash: 2ff2adb1702c9e3a7d4f2c9db329b26d
humanhash: louisiana-xray-kansas-fanta
File name:Número de factura 409092110970.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:172'802 bytes
First seen:2022-03-08 06:40:34 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:5MrnuSQ5vO9XmyxSTDm8URunNshYWKyeHnQkl+Fupu0SVQunKSyAWRHxLw8CPIh/:cuS7xcDoR4NshYTysnQx8RSVBKSDyw8J
TLSH T109F3F11FBACEE8E2E007013350168573D7090AD9AD0D813F6AF819C64EF6D656B46EDE
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
23.229.34.104:1785

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
23.229.34.104:1785 https://threatfox.abuse.ch/ioc/392928/

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/248081/
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/952292
Signature
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 584773 Sample: N#U00famero de factura 4090... Startdate: 08/03/2022 Architecture: WINDOWS Score: 64 22 Found malware configuration 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected STRRAT 2->26 8 cmd.exe 2 2->8         started        10 cmd.exe 1 2->10         started        process3 process4 12 java.exe 5 8->12         started        14 conhost.exe 8->14         started        16 7za.exe 73 10->16         started        process5 18 icacls.exe 1 12->18         started        process6 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad91a7882b4c131aa764d6072fd13e2974abcd95dd8fac166b01316813948274/
Threat name:
ByteCode-JAVA.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2022-03-08 06:41:10 UTC
File Type:
Binary (Archive)
Extracted files:
68
AV detection:
9 of 42 (21.43%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwi2pcbljqjrvj3e2yds7uj6ff2kxtmv3wh2yftlaeywqe4uqj2a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence suricata
Link:
https://tria.ge/reports/220308-hfrqhsfabm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
suricata: ET MALWARE STRRAT CnC Checkin
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/ad91a7882b4c131aa764d6072fd13e2974abcd95dd8fac166b01316813948274

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/248081/

Comments