🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8209bd177e8200aaf47af1b063fcacc33c48c75530f83f5c08af41e98543e49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8209bd177e8200aaf47af1b063fcacc33c48c75530f83f5c08af41e98543e49
SHA3-384 hash: 29385c00d6753794a71484704cb93532833e106e78434c5ff3ccb9a831c13645335783eeeb982e85d8953fc812e97995
SHA1 hash: 8158084df6565fdda414aca65d230b96c60dbd1a
MD5 hash: e14056d42f0dc171f938e41784a44cdf
humanhash: island-india-ceiling-bulldog
File name:Img~039873655-3987365367383.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:168'781 bytes
First seen:2022-06-21 12:57:49 UTC
Last seen:2022-06-23 09:44:58 UTC
File type:Java file jar
MIME type:application/zip
ssdeep 3072:IwCxMr+YMmf4EU9Q6n0u9TbrkFgOUcx0vOM4rkxsFU60xKFJs5DY:Ib0fD1u9T0FgOUI0liFMxKLeM
TLSH T18BF3F15F3EEF44FDE05BA9364012912F6A0C4699E4A4A58B36EC188B4934D8F4F52DCF
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:jar STRRAT


Avatar
abuse_ch
STRRAT C2:
91.193.75.131:8363

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.193.75.131:8363 https://threatfox.abuse.ch/ioc/718159/

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Strrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/281989/
Detection(s):
Java.Malware.CVE_2021_44228-9915819-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62b1c09af4dd1ffb77a87bc1/reports/171287cd-8daf-4e19-9e28-fb9e8c2cd1f7/overview
Result
Threat name:
STRRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1017120
Signature
Multi AV Scanner detection for submitted file
Yara detected STRRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 649616 Sample: Img#U007e039873655-39873653... Startdate: 21/06/2022 Architecture: WINDOWS Score: 56 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected STRRAT 2->27 8 cmd.exe 2 2->8         started        10 cmd.exe 1 2->10         started        process3 process4 12 java.exe 5 8->12         started        15 conhost.exe 8->15         started        17 7za.exe 77 10->17         started        dnsIp5 23 192.168.2.1 unknown unknown 12->23 19 icacls.exe 1 12->19         started        process6 process7 21 conhost.exe 19->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8209bd177e8200aaf47af1b063fcacc33c48c75530f83f5c08af41e98543e49/
Threat name:
ByteCode-JAVA.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2022-06-21 12:58:07 UTC
File Type:
Binary (Archive)
Extracted files:
70
AV detection:
17 of 41 (41.46%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xaqjxulx5aqavl2hv4nqmp6kzqz4jddvkmhyh5oarl2b5gcuhzeq._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer suricata trojan
Link:
https://tria.ge/reports/220621-p7gg7afhb5/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
STRRAT
suricata: ET MALWARE STRRAT CnC Checkin
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
STRRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8209bd177e8200aaf47af1b063fcacc33c48c75530f83f5c08af41e98543e49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/281989/

Comments