MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d
SHA3-384 hash: f42ff2e770d2f481e5f289e07411de06163ab38587a4aef6fc925d6edb663eaf48d734f365a573ebaa8b1519cafbfb2f
SHA1 hash: a49408dfee4a32da9b342d050ff990abc627d92b
MD5 hash: 2fc3e196a69266976b818ddc4c7833d6
humanhash: avocado-california-carbon-mango
File name:NEW ORDER.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:276'817 bytes
First seen:2025-02-14 04:40:08 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 6144:KqTBRHRPHuWkh9HgQTetWUhv1AyeKDwciWBW:DRHR/uWkh9hehv1ltZW
TLSH T17244085A3F5990B5E25360330654E2AFBD28E8DBC600558F1BFD5C1C9C78C588B6ABCB
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
195.177.95.117:7800

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
195.177.95.117:7800 https://threatfox.abuse.ch/ioc/1411906/

Intelligence

File Origin
# of uploads :
1
# of downloads :
591
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
strrat
Create hunting rule
ID:
1
File name:
NEW ORDER.jar
Verdict:
Malicious activity
Analysis date:
2025-02-14 04:41:09 UTC
Tags:
java rat strrat remote evasion stealer
Link:
https://app.any.run/tasks/003b5e2a-8c90-4cde-ae26-8eb00266c653

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Java.Packer.Allatori-1
Create hunting rule

Sanesecurity.Malware.27013.JsHeur.Obfs.UNOFFICIAL
Create hunting rule

Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

TwinWave.EvilJAR.e_STRRAT_Shuffle.20240412.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67aec92e28ab76d43a5ae056
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/67aec92e5c9e85f7896769ca/reports/e3880e8a-7c96-4f9e-ae14-c117d0fb7d6f/overview
Verdict:
Malicious
Labled as:
Trojan.Java.Agent
Link:
https://www.hybrid-analysis.com/sample/aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d
Result
Threat name:
Caesium Obfuscator, STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad.expl
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1614801
Signature
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AllatoriJARObfuscator
Yara detected Caesium Obfuscator
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1614801 Sample: NEW ORDER.jar Startdate: 14/02/2025 Architecture: WINDOWS Score: 88 23 repo1.maven.org 2->23 25 github.com 2->25 27 dualstack.sonatype.map.fastly.net 2->27 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 4 other signatures 2->41 9 cmd.exe 2 2->9         started        signatures3 process4 file5 21 C:\cmdlinestart.log, ASCII 9->21 dropped 12 java.exe 26 9->12         started        15 conhost.exe 9->15         started        process6 dnsIp7 29 github.com 140.82.121.3, 443, 49734, 49738 GITHUBUS United States 12->29 31 140.82.121.4, 443, 49956, 49961 GITHUBUS United States 12->31 33 2 other IPs or domains 12->33 17 icacls.exe 1 12->17         started        process8 process9 19 conhost.exe 17->19         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d/
Threat name:
ByteCode-JAVA.Trojan.Strrat
Create hunting rule
Status:
Suspicious
First seen:
2025-02-14 04:40:12 UTC
File Type:
Binary (Archive)
Extracted files:
500
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v24ad25eakspcd6r6fjinf2phvje5uq7bhso3tsaksgt5r2ngkoq._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat discovery
Link:
https://tria.ge/reports/250214-falwzasmcn/
Behaviour
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Downloads MZ/PE file
Malware Config
C2 Extraction:
195.177.95.117:7800
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
STRRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aeb801eba402a4f10fd1f15286974f3d524ed21f09e4edce40548d3ec74d329d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:STRRAT
Create hunting rule
Author:NDA0E
Description:Detects STRRAT config filename
Rule name:strrat_jar_v1
Create hunting rule
Author:RandomMalware
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments